Security vulnerabilities and automated fixes for middleware issues
11 posts found
A critical authorization flaw in `src/v1/routes/index.js` allowed any authenticated API key holder to access arbitrary budgets by manipulating the `budgetSyncId` URL parameter. The fix introduces an environment-based allowlist that validates budget access before processing requests.
A high-severity denial of service vulnerability in `src/index.js` allowed attackers to exhaust server resources through unlimited requests to `/api/register` and `/api/captcha`. The fix implements in-memory rate limiting middleware, restricting captcha generation to 20 requests per minute and registration to 10 requests per minute per IP.
A HIGH severity Cross-Site Request Forgery (CSRF) vulnerability was found in `integrationExamples/topics/topics-server.js`, an Express.js demo server that lacked any CSRF protection middleware. The file was deleted entirely after assessment determined it posed unnecessary risk to downstream consumers of this Node.js library.
A critical denial-of-service vulnerability was discovered in a FastAPI application controlling Tesla Powerwall systems, where all 113+ API endpoints—including critical control endpoints for `/control/reserve` and `/control/mode`—lacked any rate limiting protection. An attacker could flood these endpoints with unlimited requests, exhausting server resources and disrupting powerwall monitoring and control operations. The fix introduces a configurable, pure-ASGI rate limiting middleware that can be
A high-severity arbitrary server-side file read vulnerability (GHSA-f4xh-w4cj-qxq8) was discovered in LangSmith SDK's `TracingMiddleware`, affecting versions prior to 0.8.18. An attacker able to influence tracing requests could potentially read arbitrary files from the server's filesystem. Upgrading from version 0.8.15 to 0.8.18 in `poetry.lock` and `pyproject.toml` closes the attack surface entirely.
CVE-2026-64642 is a high-severity authentication bypass vulnerability in Next.js that affects App Router applications using Turbopack with a single locale configuration. The flaw allows attackers to circumvent middleware and proxy security controls, potentially gaining unauthorized access to protected routes. Upgrading from Next.js 16.2.7 to 16.2.11 closes the vulnerability entirely.
An Express.js application in `src/server.js` was missing CSRF (Cross-Site Request Forgery) protection middleware, leaving all state-changing endpoints vulnerable to forged requests from malicious sites. The fix introduces the `csrf` package to generate and validate tokens on non-GET requests, while exempting API-key-authenticated clients. This defensive hardening raises the bar against automated exploit chaining.
A publicly accessible Express.js API endpoint in `app/api/cameras.js` was missing CSRF protection, leaving state-changing requests (POST, PUT, DELETE, PATCH) vulnerable to cross-site request forgery attacks. The fix introduces Origin/Referer header validation middleware in `app/index.js` and removes a redundant Express instance from `cameras.js` that bypassed the application's middleware chain.
A critical authentication bypass vulnerability (CVE-2026-64642) was discovered in Next.js versions prior to 16.2.11, specifically affecting App Router applications using Turbopack with a single locale configuration. This vulnerability allowed attackers to bypass middleware and proxy protections, potentially gaining unauthorized access to protected routes and resources that should have been secured by authentication checks.
A critical authorization bypass was discovered in lib/router.js where readOnly and noDelete configuration options were only enforced through UI controls, not server-side middleware. Any authenticated user could bypass these restrictions by sending direct HTTP requests to perform destructive operations like database deletion or document modification. The fix adds Express middleware that enforces these security modes at the server level, blocking POST, PUT, and DELETE requests when appropriate.
A critical middleware and proxy bypass vulnerability (CVE-2026-64642) was discovered in Next.js 16.0.7 when using the App Router with Turbopack and single locale configurations. This vulnerability could allow attackers to circumvent security middleware and access protected routes. The fix requires upgrading Next.js from version 16.0.7 to 16.2.11, which patches the routing logic that handles locale-based request interception.