Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

miniflare

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Miniflare vulnerable to Server-Side Request Forgery (SSRF)

    CVE-2023-7078 · GHSA-fwvg-2739-22v7

    Affected
    • npm miniflare >= 3.20230821.0, < 3.20231030.2
    Fixed in
    3.20231030.2· Vendor fix available
    Issue
    Impact Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers. Patches The issue was fixed in miniflare@3.20231030.2. Workarounds Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option. References - https://github.com/cloudflare/workers-sdk/pull/4532

    Recommended action: Upgrade to 3.20231030.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →