Description
The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them.
Recommendation
Update the @finastra/nestjs-proxy package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.7.0
- Patched version(s): 0.7.0
References
Could your website be exposed too?
SmartScanner can check your website for Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy - CVE-2022-31070
- Potential exposure of tokens to an Unauthorized Actor - CVE-2022-21671
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection - CVE-2026-44486
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023