Server side request forgery in @isomorphic-git/cors-proxy

ALTO 7.5CVE-2021-23664 · GHSA-v82v-rq72-phq9 · SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 · Published 21/01/2022 · updated 17/06/2026

En resumen

CVE-2021-23664 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a cors-proxy (isomorphic-git), @isomorphic-git/cors-proxy.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.5% de las vulnerabilidades.
Solución: actualizar a 2.7.1 o posterior.

Package	Affected versions	Patched versions
cors-proxy isomorphic-git	`< 2.7.1`	`2.7.1`
@isomorphic-git/cors-proxy npm	`< 2.7.1`	`2.7.1`

Description

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

NVD description

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

References

nvd.nist.gov/vuln/detail/CVE-2021-23664 · ADVISORY
isomorphic-git/cors-proxy commit 1b1c91e · WEB
isomorphic-git/cors-proxy · PACKAGE
snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free