Tndud042713

An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route matching, the `request.url` retains the original encoded form, and the rewrite process uses a literal string replacement against the decoded prefix. This encoding mismatch allows a remote attacker to send requests with URL-encoded characters in the configured prefix, causing the proxy to match the route but skip the rewrite. Consequently, the raw encoded path is forwarded to the upstream server, which then decodes the path and serves it. This leads to a full proxy path bypass, exposing internal or administrative endpoints that were intended to be hidden via the `rewritePrefix` configuration, potentially resulting in unauthorized administrative actions and sensitive data exposure.

When parsing a Set-Cookie header, the software accepts any SameSite attribute value containing Strict, Lax, or None as a substring instead of requiring a case-insensitive exact match as specified by RFC 6265. This allows non-spec values to be silently mapped to standard tokens; for instance, SameSite=NoneOfYourBusiness is parsed as None, and SameSite=StrictLax is parsed as Lax. Applications that consume Set-Cookie headers via fetch or proxy code paths and rely on the parsed `sameSite` attribute can be coerced by a malicious or non-compliant server into applying a weaker SameSite policy, degrading the intended cookie enforcement.

The cookie parser in the `parseSetCookie` function percent-decodes cookie values using `qsUnescape`, which converts encoded sequences such as %0D%0A, %00, %3B, and %3D into literal byte equivalents. This behavior deviates from RFC 6265 §5.4 and browser standards, which do not specify such decoding. Applications that use `parseSetCookie`, `parseCookie`, or `getSetCookies` and subsequently forward these parsed values into response headers (such as proxies, middleware, or SSR frameworks) are susceptible to HTTP response header injection. This allows an attacker-controlled upstream source to inject arbitrary Set-Cookie, Location, or Cache-Control headers into the downstream response, potentially leading to session fixation, open redirect, or cache poisoning.

A Denial of Service issue exists due to the way the `append-field` dependency parses bracket notation in field names within multipart form data. Because there is no limit on nesting depth, an attacker can send a single HTTP request with a crafted multipart body to force the allocation of deeply nested object structures, leading to excessive CPU and memory consumption.

A quadratic time complexity issue exists in the smartquotes rule when the `typographer: true` option is enabled. An attacker can provide markdown input containing a large number of consecutive quotation marks, causing the parser to consume excessive CPU resources and leading to a denial of service. This occurs because the `replaceAt()` function in `lib/rules core/smartquotes.mjs` modifies the `token.content` using string slicing and concatenation for every quote character found. Since each slice operation is O(n) and is performed for each of the n quotes, the overall complexity becomes O(n^2).

An HTML injection issue exists in the JSX server-side rendering (SSR) process. Attackers can inject unintended HTML by using malformed attribute names. By crafting attribute keys that include characters such as quotes or angle brackets, an attacker can break HTML tag boundaries to inject arbitrary attributes or elements.

An SMTP command injection issue exists in the transport `name` configuration option used in EHLO, HELO, and LHLO commands. The `name` parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed (CRLF) characters. An attacker capable of influencing this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks. This occurs within the `lib/smtp-connection/index.js` file during connection initialization, where the ` sendCommand()` function writes the string directly to the socket.

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions 15.10.0 through 20.8.7 contain a code injection issue in the `ECMAScriptModuleCompiler` component. This allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression. The quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.