Description
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.
Recommendation
Update the nuxt-api-party package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.22.0
- Patched version(s): 0.22.0
References
- GHSA-3wfp-253j-5jxv
- fetch.spec.whatwg.org
- infra.spec.whatwg.org
- CVE-2023-49799
- CWE-918
- CAPEC-310
- OWASP 2021-A10
- OWASP 2021-A6
Related Issues
- Double spend in snarkjs - CVE-2023-33252
- DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
- Path Traversal in droppy - CVE-2020-7757
- HTML Injection in preact - Vulnerability
- Tags:
- npm
- nuxt-api-party
Anything's wrong? Let us know Last updated on December 12, 2023