Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@portkey-ai/gateway

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9npmAmendedPublished

    Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

    CVE-2025-66405 · GHSA-hhh5-2cvx-vmfp

    Affected
    • npm @portkey-ai/gateway < 1.14.0
    Fixed in
    1.14.0· Vendor fix available
    Issue
    The gateway determines the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF (CWE-918) attack Impact This vulnerability can be exploited to force the server to make requests to arbitrary hosts on the internal network. This could allow an attacker to exfiltrate sensitive data, for instance, by accessing the AWS metadata service. Patches The issue is patched in 1.14.0 (https://github.com/Portkey-AI/gateway/pull/1372) The vulnerability resides within the gateway's request processing function which handles the x-portkey-custom-host header. This parameter was passed directly or with insufficient validation/sanitization to an internal HTTP request function. The fix (v1.14.0) implements a robust allow-list policy: 1. All custom host inputs are now strictly validated to ensure the resulting URI points only to…

    Recommended action: Upgrade to 1.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →