CVE-2026-33637: Faraday Incomplete Fix Allows Protocol-Relative URI Bypass
Summary
CVE-2026-33637: Faraday::Connection#build_exclusive_url still allows protocol-relative host override when the request target is provided as a URI object instead of a String. Affects faraday versions >= 2.0.0, < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Faraday is a popular HTTP client library for Ruby that simplifies making requests to web services. It provides a flexible interface for building connections, handling middleware, and managing request/response cycles. The library is widely used in Ruby applications for its ease of use and extensibility. However, it has recently been found to have a vulnerability that allows attackers to bypass host scoping through protocol-relative URIs, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from the method Faraday::Connection#build_exclusive_url, which permits protocol-relative host overrides when a request target is provided as a URI object instead of a string. This flaw allows an attacker to redirect requests from a fixed-base Faraday connection to a malicious host while retaining connection-scoped headers, such as Authorization. This can lead to off-host request forgery, where sensitive headers are sent to an attacker-controlled server, compromising the application's security.
How To Fix
Minimum fixed version
2.14.2
This is the first release that contains the fix.
gem install faraday -v 2.14.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using protocol-relative URIs in your application. Ensure that any URIs passed to conn.get(...), conn.post(...), or req.url(...) are fully qualified with the appropriate scheme (http or https). For example:
require 'faraday'
require 'faraday/net_http'
conn = Faraday.new(url: 'http://trusted.example/base', headers: { 'Authorization' => 'Bearer secret-token' }) { |f| f.adapter :net_http }
target = 'http://127.0.0.1:4567/pwn'
resp = conn.get(target)
puts resp.status
puts resp.body
Conclusion
The vulnerability CVE-2026-33637 in the Faraday library poses a significant risk by allowing protocol-relative URIs to bypass host scoping. It is crucial to update to the patched version 2.14.2 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in your applications.
See every vulnerability recorded for faraday →
FAQ
CVE-2026-33637 is a vulnerability in the Faraday HTTP client library that allows protocol-relative URIs to bypass host scoping, potentially leading to unauthorized access.
If your application uses Faraday with a fixed-base connection and allows protocol-relative URIs, it could inadvertently send sensitive headers to an attacker-controlled host.
Faraday versions up to and including 2.14.1 are affected. The vulnerability is fixed in version 2.14.2 and later.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
As a temporary measure, avoid using protocol-relative URIs and ensure all URIs are fully qualified with the appropriate scheme.
References
Related vulnerabilities
Recent vulnerabilities recorded for faraday.
