Server-Side Request Forgery in nuxt-api-party
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.
Summary
`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| johannschopplich | nuxt-api-party | before 0.22.1 | 0.22.1 | Patch available | CNA |
| — | nuxt-api-party (npm) | before 0.22.0 | 0.22.0 | Patch available | GHSA-3wfp-253j-5jxv |
- nuxt-api-party Vendorjohannschopplich Affected before 0.22.1 Fixed in 0.22.1 Patch available CNA
- nuxt-api-party (npm) Vendor— Affected before 0.22.0 Fixed in 0.22.0 Patch available GHSA-3wfp-253j-5jxv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:* | up to 0.21.3 | Vulnerable | johannschopplich |
- cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:* Versions up to 0.21.3 Vulnerable ·johannschopplich
Remediation
- Fix · CNA nuxt-api-party (johannschopplich) Fixed in 0.22.1
- Fix · GHSA-3wfp-253j-5jxv nuxt-api-party (npm) Fixed in 0.22.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49799
- 2026-10-03 Alias added: GHSA-3wfp-253j-5jxv
References
Other 7
- https://fetch.spec.whatwg.org/
- https://fetch.spec.whatwg.org/#http-whitespace-byte
- https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31
- https://infra.spec.whatwg.org/#byte-sequence
- https://github.com/johannschopplich/nuxt-api-party/commit/72762a200fc19d997a0f84bce578c28698dc5270
- https://fetch.spec.whatwg.org
- https://github.com/johannschopplich/nuxt-api-party
More johannschopplich Nuxt Api Party vulnerabilities
- TI-2023-27207 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party CVSS 3.1HIGH 7.5
Sources
- CVE-2023-49799 · CVE Program
- CVE-2023-49799 · NVD
- FIRST EPSS
- GHSA-3wfp-253j-5jxv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences