Read the docs
TI-2022-08635 Aliases CVE-2022-24822GHSA-3hjg-vc7r-rcrw

Denial of Service in @podium/layout and @podium/proxy

Priority MEDIUM 42CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01659 76th percentileScored 2026-11-07
Fix Fixed proxy (podium-lib): 4.6.110, 4.2.74@podium/layout (npm): 4.6.110+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
podium-libproxybefore 4.6.110; before 4.2.744.6.110, 4.2.74Patch availableCNA
—@podium/layout (npm)before 4.6.1104.6.110Patch availableGHSA-3hjg-vc7r-rcrw
—@podium/proxy (npm)before 4.2.744.2.74Patch availableGHSA-3hjg-vc7r-rcrw
  • proxy Vendorpodium-lib Affected before 4.6.110; before 4.2.74 Fixed in 4.6.110, 4.2.74 Patch available CNA
  • @podium/layout (npm) Vendor— Affected before 4.6.110 Fixed in 4.6.110 Patch available GHSA-3hjg-vc7r-rcrw
  • @podium/proxy (npm) Vendor— Affected before 4.2.74 Fixed in 4.2.74 Patch available GHSA-3hjg-vc7r-rcrw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:finn:podium_layout:*:*:*:*:*:node.js:*:*before 4.6.110VulnerableFinn
cpe:2.3:a:finn:podium_proxy:*:*:*:*:*:node.js:*:*before 4.2.74VulnerableFinn
  • cpe:2.3:a:finn:podium_layout:*:*:*:*:*:node.js:*:* Versions before 4.6.110 Vulnerable ·Finn
  • cpe:2.3:a:finn:podium_proxy:*:*:*:*:*:node.js:*:* Versions before 4.2.74 Vulnerable ·Finn

Remediation

  • Fix · CNA proxy (podium-lib) Fixed in 4.6.110, 4.2.74
  • Fix · GHSA-3hjg-vc7r-rcrw @podium/layout (npm) Fixed in 4.6.110 Advisory →
  • Fix · GHSA-3hjg-vc7r-rcrw @podium/proxy (npm) Fixed in 4.2.74 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24822
  2. 2026-10-03 Alias added: GHSA-3hjg-vc7r-rcrw

References

Patch 2

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences