AIKIDO-2025-10193

TL;DR

Affected versions of this package are affected by a design flaw where it constructs a Request object using the incoming request's properties (method, headers, body) and builds a new URL from req.protocol and req.hostname (derived from untrusted headers like X-Forwarded-Host or Host). This request is forwarded to the tainted URL without proper validation, allowing forgery attacks like crafting a malicious site that sends forged state-changing requests, such as POST, using the victim's session cookies.