AIKIDO-2026-326058
portless is vulnerable to Exposure of Resource to Wrong Sphere
65
Medium Risk
This Affects:
portlessTL;DR
Portless runs a local HTTPS reverse proxy and an HTTP-to-HTTPS redirect listener that route named .localhost hostnames to local apps. Outside LAN mode, these listeners were started without an explicit bind address, so Node bound them to all network interfaces instead of loopback. As a result, the proxy and every local app registered behind it were reachable from other machines on the same LAN, VPN, or network interface even though users expected local-only access. The fix binds the proxy and redirect listeners to 127.0.0.1 and ::1 unless LAN mode is explicitly enabled.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
portless is vulnerable to Exposure of Resource to Wrong Sphere in versions 0.1.0 - 0.15.3.
How to fix this
Upgrade the portless library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant