What’s Vulnerable › Vulnerabilities

CVE-2025-55152: oak: ReDoS in x-forwarded-proto and x-forwarded-for headers

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-09 · updated 2026-06-17
• Weakness: CWE-400

Description

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.

Affected products

• oakserver oak: before 17.1.6

References

• https://github.com/oakserver/oak/commit/b60e60330ef227707c4dc13ef0ea36192d894f44
• https://github.com/oakserver/oak/security/advisories/GHSA-r3v7-pc4g-7xp9

Get alerted when CVE-2025-55152 or the next vulnerability affects your stack