CVE-2025-55152
oak: ReDoS in x-forwarded-proto and x-forwarded-for headers
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 9, 2025
- Updated
- Aug 11, 2025
- Reserved
- Aug 7, 2025
Description
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
oakoakserver |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.