CVE-2023-7078: Server-Side Request Forgery (SSRF) in Miniflare

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-29 · updated 2026-06-17
Weakness: CWE-918

Description

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

Affected products

Cloudflare miniflare: from 3.20230821.0 before 3.20231030.2 — fixed in 3.20231030.2

How to fix

Upgrade to a fixed version: Cloudflare miniflare 3.20231030.2. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7
https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7

Get alerted when CVE-2023-7078 or the next vulnerability affects your stack