CVE-2025-55152CWE-1333CWE-400

oak: ReDoS in x-forwarded-proto and x-forwarded-for headers

Medium · published August 9, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-400 · Uncontrolled Resource Consumption
Published
2025-08-09T01:29Z
EPSS history
Timeline
  • 09 AUG 01:29Z
    oak: ReDoS in x-forwarded-proto and x-forwarded-for headers
    cvelistv5