Bjohansebas

When a proxy entry is configured to forward WebSockets, the server forwards non-HMR (Hot Module Replacement) WebSocket upgrade requests to the proxy target without validating the Host or Origin headers. This bypasses the allowedHosts protection. Consequently, a malicious web page visited by a developer can establish a cross-origin WebSocket connection through the development server to read from and write to the proxied backend, even if the server is bound to the loopback address.

The unauthenticated 'open-editor' endpoint validates the Host header using a regular expression designed for browser Origin schemes. A Host value starting with `file:` or an extension scheme can bypass the hostname and `allowedHosts` checks. A network peer can send a request with a malformed Host that passes validation, causing the endpoint's URL construction to fail. In default non-production mode, the server returns an HTTP 500 response containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers.

A race condition exists in the multipart parser when configured with an asynchronous `fileFilter()` function. If a request is aborted while an asynchronous `fileFilter()` is still pending, the callback may resume a parsing stream that has already been torn down. This causes the underlying parser to emit an error on a stream without an error listener, resulting in an unhandled error event that crashes the Node.js process, leading to a Denial of Service. This issue affects any application using an asynchronous `fileFilter()` regardless of the storage engine used.

An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pipes it into a decompression stream but fails to attach an error listener after reading the body. If a payload contains one valid compressed frame followed by trailing bytes, the application responds normally to the valid frame, but the trailing bytes trigger an error in the finished decoder. This error is re-thrown as an uncaught exception, terminating the process. Since body parsing occurs before routing, any endpoint that parses a body is affected.

multer is a Node.js middleware for handling multipart/form-data uploads. When a request using disk storage is aborted during the upload process, file writes that finish after the abort cleanup has executed are not deleted. This results in orphaned files remaining on the disk. A remote unauthenticated attacker can exploit this by repeatedly starting and aborting uploads to fill the disk space, leading to a denial of service.

This Node.js and Express compression middleware contains a memory leak. When a client aborts a connection while a compressed response is being transmitted, the zlib stream used for compression is not destroyed. A remote unauthenticated attacker can exploit this by repeatedly initiating requests and disconnecting prematurely, leading to the exhaustion of native zlib memory and causing the server to crash. This results in a Denial of Service (DoS), a condition where a service is unavailable to its intended users.

An issue exists in the Express view engine wrapper for Handlebars where the Node.js process can crash during output escaping. This occurs when an async helper, registered via `registerAsyncHelper()`, resolves to an object with a `toHTML` property that is truthy but not callable. The `escapeExpression()` function attempts to call `toHTML` as a method, resulting in a TypeError. Because the async substitution executes on a later tick outside the render function's try/catch block, the error becomes an uncaught exception that terminates the process without sending a response. This can be triggered remotely if an async helper resolves to an externally influenced object, such as parsed JSON.

An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records.

When using the disk storage engine for handling multipart/form-data, the software fails to close the underlying write file descriptor if an upload is aborted or truncated before the write stream finishes. Although the visible file is removed, the open descriptor remains, causing a leak of file descriptors and disk blocks. A remote attacker can exploit this by sending repeated aborted or malformed multipart uploads to an upload route, potentially exhausting system resources and leading to a denial of service.

A race condition exists in the file stream handling when an application utilizes an asynchronous `fileFilter` in conjunction with the `fileSize` limit. This allows files that exceed the configured size limit to bypass the limit rejection. The impact is limited as the underlying multipart parser still truncates the stream at the size limit, meaning the issue is a bypass of the rejection mechanism rather than uncontrolled resource consumption.

The `registerAsyncHelper` API in the hbs Express view engine bypasses the automatic HTML escaping of Handlebars. During the first render pass, an async helper returns an opaque placeholder that is escaped; however, hbs subsequently replaces this placeholder with the raw callback return value without escaping it. This occurs across cached, uncached, and layout render paths. If an application passes attacker-influenced data, such as user-supplied content from a database, into an async helper callback, it can lead to stored or reflected cross-site scripting (XSS), where arbitrary HTML and JavaScript are injected into the server-rendered page.

When the parser is configured with an invalid `limit` option value, such as an unparseable string or NaN (Not-a-Number), the request body size check is silently skipped. This occurs because the internal parsing mechanism returns null, causing applications that rely on the `limit` parameter as their primary safeguard to accept arbitrarily large payloads. This can lead to excessive memory and CPU consumption, resulting in a denial of service.

An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host header or a WebSocket upgrade request to the `/ws` endpoint with a malformed Origin header. The malformed values trigger an uncaught exception in the host-validation path, crashing the development server. The impact is limited to the availability of the server, with no risk of code execution or data disclosure.

Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. This allows any website visited by a developer to trigger these endpoints cross-origin. An attacker can open arbitrary local files in the developer's editor, including those outside the project root. Additionally, repeated requests can spawn multiple editor processes and force recompilations, leading to system performance degradation.

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.

A permissive user-configured proxy with a broad context (e.g., '/') and `ws: true` intercepts the development server's own Hot Module Replacement (HMR) WebSocket and forwards it to the proxy target. This results in the leakage of the browser's cookies and Origin header to the backend and bypasses the development server's Host/Origin validation. Additionally, this causes corruption of the HMR socket as both the HMR and the proxy attempt to write to the same socket.