TI-2021-06178 Aliases CVE-2021-23664 GHSA-v82v-rq72-phq9

Server-side request forgery (SSRF) in @isomorphic-git/cors-proxy

MEDIUM 40CWE-918Published 2022-01-21 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

Why it matters now

EPSS 0.01389 72nd percentileScored 2026-11-07

Fix Fixed @isomorphic-git/cors-proxy: 2.7.1@isomorphic-git/cors-proxy (npm): 2.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	@isomorphic-git/cors-proxy	before 2.7.1	2.7.1	Patch available	CNA
—	@isomorphic-git/cors-proxy (npm)	before 2.7.1	2.7.1	Patch available	GHSA-v82v-rq72-phq9

@isomorphic-git/cors-proxy Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
@isomorphic-git/cors-proxy (npm) Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available GHSA-v82v-rq72-phq9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:isomorphic-git:cors-proxy::::::::	before 2.7.1	Vulnerable	isomorphic-git

cpe:2.3:a:isomorphic-git:cors-proxy:*:*:*:*:*:*:*:* Versions before 2.7.1 Vulnerable ·isomorphic-git

Remediation

Fix · CNA @isomorphic-git/cors-proxy Fixed in 2.7.1
Fix · GHSA-v82v-rq72-phq9 @isomorphic-git/cors-proxy (npm) Fixed in 2.7.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-23664
2026-10-03 Alias added: GHSA-v82v-rq72-phq9

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences