SSRF & Credentials Leak

Description

nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.

Recommendation

Update the nuxt-api-party package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.22.0
• Patched version(s): 0.22.0

References

• GHSA-3wfp-253j-5jxv
• fetch.spec.whatwg.org
• infra.spec.whatwg.org
• CVE-2023-49799
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability - CVE-2023-48711
• Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
• matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nuxt-api-party