CVE-2026-27818: TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-26 · updated 2026-06-17
Weakness: CWE-20

Description

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.

Affected products

terriajs-server: before 4.0.3 — fixed in 4.0.3

How to fix

Upgrade to a fixed version: terriajs-server 4.0.3. Check the vendor advisory for mitigations.

References

https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f
https://github.com/TerriaJS/terriajs-server/security/advisories/GHSA-w789-49fc-v8hr

Get alerted when CVE-2026-27818 or the next vulnerability affects your stack