AIKIDO-2025-10284

TL;DR

Affected versions of this package fail to properly validate that ports in the path proxy are numerical, allowing an attacker to manipulate the proxy target. The vulnerable code constructs a proxy URL without sanitizing req.params.port, enabling an attacker to inject malicious input (e.g., a domain instead of a port) and redirect traffic to an arbitrary domain. It could lead to server-side request forgery (SSRF) or data exfiltration by proxying traffic to an attacker-controlled server.