Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string such as: causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This has been patched in version 2.14.3 and backported to 1.10.6.
Recommended action: Upgrade to 2.14.3 or 1.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Faraday::Connection#buildexclusiveurl still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to an attacker-controlled host while preserving connection-scoped headers such as Authorization. Affected Component - Repository File(s)/Endpoint(s): - lib/faraday/connection.rb - lib/faraday/request.rb - spec/faraday/connectionspec.rb - spec/faraday/requestspec.rb - Function(s): - Faraday::Connection#buildexclusiveurl - Faraday::Connection#runrequest - Faraday::Request#url - Faraday::Request#toenv - Version(s) Tested: - Faraday 2.14.1 - repository HEAD a01039c948d3e9e41e03d152aed7244f0fb4d5ca Attacker Profile - Who: A remote user who can influence a per-request target/path in an application that uses a fixed-base Faraday connection - Access Required: Ability to supply data that the application…
Recommended action: Upgrade to 2.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Faraday's buildexclusiveurl method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), buildurl(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). The ./ prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with /, so protocol-relative URLs bypass it entirely. Example: Patches Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected. Workarounds NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an…
Recommended action: Upgrade to 2.14.1 or 1.10.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.