7Thparkk

**Name of the Vulnerable Software and Affected Versions** http-proxy-middleware versions 0.16.0 through 2.0.9 http-proxy-middleware versions 3.0.0 through 3.0.5 http-proxy-middleware versions 4.0.0 through 4.0.9 **Description** An issue exists in the `router` proxy-table implementation where host+path selectors use unanchored substring matching on request metadata. When a router key contains a `/`, the `getTargetFromProxyTable()` function concatenates the `Host` header and the request URL into a single string and checks if the configured key is a substring of that combined value. This allows an attacker to bypass routing boundaries by providing a crafted `Host` header that acts as a superstring match for the configured key, potentially routing requests to unintended backends. This affects the `createProxyMiddleware()` function when configured with host+path rules. **Recommendations** Update to version 2.0.10, 3.0.6, or 4.1.0 depending on the major version in use. As a temporary workaround, avoid using host+path selectors in the `router` configuration of `createProxyMiddleware()` until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.8.1 **Description** When the `fetch()` function is called, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the initial hostname check but resolves to a denied IP address, effectively bypassing network isolation rules. This can lead to unauthorized access to blocked hosts, such as `localhost` or internal services, particularly when running untrusted or third-party code. **Recommendations** Update to version 2.8.1. As a temporary mitigation, avoid granting `--allow-net` to untrusted code that relies on `--deny-net` restrictions for security.