AIKIDO-2026-11138
http-types is vulnerable to Use of Unmaintained Third Party Components
50
Medium Risk
This Affects:
http-typesTL;DR
Authorization::value uses HeaderValue::value with the claim that the internal string is ASCII, but Authorization::new and Authorization::set_credentials accept arbitrary String credentials without validation. As a result, safe code can construct a header value containing non-ASCII UTF-8 while the implementation assumes ASCII. The http-types package is no longer maintained.
Who does this affect?
You are affected if you are using this package.
Background info
http-types is vulnerable to Use of Unmaintained Third Party Components in all versions.
How to fix this
Remove any http-types package from your application.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant