VulnerabilityDeferred

CVE-2025-55152

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun.

MEDIUM 5.3EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-1333
Source: security-advisories@github.com

References

https://github.com/oakserver/oak/commit/b60e60330ef227707c4dc13ef0ea36192d894f44
https://github.com/oakserver/oak/security/advisories/GHSA-r3v7-pc4g-7xp9

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.