CVE-2025-55152: Oak Server ReDoS Vulnerability in x-forwarded-proto and x-forwarded-for Headers
Summary
CVE-2025-55152: Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers. Affects @oakserver/oak versions < 14.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @oakserver/oak package is a middleware framework for building web applications in Deno. It provides a robust set of features for handling HTTP requests and responses, routing, and middleware integration. However, it is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing specially crafted values in the x-forwarded-proto and x-forwarded-for headers, which can significantly degrade server performance.
Vulnerability Detail
The vulnerability arises from the way the Oak server processes the x-forwarded-proto and x-forwarded-for headers. Attackers can exploit this by sending requests with specially crafted header values that cause the server to consume excessive CPU resources, leading to a slowdown or denial of service. The vulnerable code can be found in request.ts at specific lines, where the headers are parsed without adequate validation, allowing for potential abuse.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement validation on the x-forwarded-proto and x-forwarded-for headers in your application to limit their length and prevent excessively long values from being processed. For example, you can add middleware to check the header lengths before processing requests:
app.use((ctx, next) => {
const maxHeaderLength = 100; // Set a maximum length for headers
if (ctx.request.headers.get('x-forwarded-proto')?.length > maxHeaderLength ||
ctx.request.headers.get('x-forwarded-for')?.length > maxHeaderLength) {
ctx.response.status = 400; // Bad Request
ctx.response.body = 'Header value too long';
return;
}
return next();
});
Conclusion
The CVE-2025-55152 vulnerability in the @oakserver/oak package poses a significant risk by allowing attackers to exploit header values, leading to potential denial of service. It is crucial to update to the patched version or implement workarounds to mitigate the risk.
See every vulnerability recorded for @oakserver/oak →
FAQ
CVE-2025-55152 is a vulnerability in the @oakserver/oak package that allows attackers to exploit the x-forwarded-proto and x-forwarded-for headers, leading to potential denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The vulnerability can lead to significant slowdowns in server performance, potentially causing denial of service for legitimate users.
You can update the package by running the command: npm update @oakserver/oak in your project directory.
Yes, you can implement validation on the x-forwarded-proto and x-forwarded-for headers to limit their length and prevent excessively long values from being processed.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oakserver/oak.
