Universe-Theori

When a debug flag is used, the software starts the Node.js Inspector but ignores the explicit bind address provided by the user. Instead of binding to the intended loopback address, it binds to a broadly reachable address, exposing the debugging interface beyond the local machine. Since the Inspector protocol allows arbitrary code evaluation, a remote party with access to this interface can achieve remote code execution on the developer's machine.

WebSocket destination paths are not properly validated against the configured rewrite prefix. The `WebSocketProxy.findUpstream()` function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the `ws` package normalize paths before transmission.