Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@podium/layout

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Denial of Service vulnerability in @podium/layout and @podium/proxy

    CVE-2022-24822 · GHSA-3hjg-vc7r-rcrw

    Affected
    • npm @podium/layout < 4.6.110
    Fixed in
    4.6.110· Vendor fix available
    Issue
    Impact An attacker using the Trailer header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. Patches @podium/layout which is the main way developers/users are vulnerable to this exploit, has been patched in version 4.6.110. All earlier versions are vulnerable. @podium/proxy which is the source of the vulnerability and is used by @podium/layout has been patched in version 4.2.74. All earlier versions are vulnerable. Workarounds It is not easily possible to work around this issue without upgrading. We recommend upgrading @podium/layout and/or @podium/proxy as soon as possible. For more information If you have any questions or comments about this advisory: Open an issue in podium-lib/issues Credits The vulnerability was reported by krynos from Ercoli Consulting via FINN.no's private bug bounty program

    Recommended action: Upgrade to 4.6.110 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →