Packages / miniflare / Security

HighVulnerabilityGHSA-fwvg-2739-22v7CVE-2023-7078Published 29 Dec 2023

Miniflare vulnerable to Server-Side Request Forgery (SSRF)

Affected releases · miniflare

  • 3.x3.20230821.0 – 3.20231030.1Fixed in 3.20231030.2

On 3.x, the newest line:

npm install miniflare@3.20231030.2
4.x

  1. Not affected

    4.20250310.0 – 4.20260730.0

    150 releases, latest

3.x

  1. Not affected

    3.0.0 – 3.20230814.1

    11 releases

  2. Affected

    3.20230821.0 – 3.20231030.1

    13 releases

  3. Fixed

    3.20231030.2 – 3.20250718.3

    87 releases

300 stable releases of miniflare, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for miniflare. It is read in your browser and sent nowhere.

What happens

Impact

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

Patches

The issue was fixed in miniflare@3.20231030.2.

Workarounds

Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.

References