Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy

Description

The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them.

Recommendation

Update the @finastra/nestjs-proxy package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-j562-c3cw-3p5g
• CVE-2022-31069
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy - CVE-2022-31070
• Potential exposure of tokens to an Unauthorized Actor - CVE-2022-21671
• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection - CVE-2026-44486

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@finastra/nestjs-proxy