Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-49799: nuxt-api-party can be tricked into external requests
CVE-2023-49799 · published 2 years ago
Summary
The nuxt-api-party module that forwards API calls can be fooled into contacting any internet address by adding hidden whitespace before the URL. This lets an attacker make the server reach outside sites, potentially exposing credentials or internal data. Upgrade to version 0.22.1 or revert to the older URL‑checking method to stop the problem.
What to do
- Update GitHub Actions nuxt-api-party to version 0.22.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | nuxt-api-party |
< 0.22.0 Fix: upgrade to 0.22.0
|
| – | johannschopplich | nuxt_api_party |
<= 0.21.3 cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:* |
Original advisory text
Server-Side Request Forgery in nuxt-api-party
`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.
References
- https://github.com/johannschopplich/nuxt-api-party/commit/72762a200fc19d997a0f84...
- https://github.com/advisories/GHSA-3wfp-253j-5jxv
- https://fetch.spec.whatwg.org/ URL
- https://fetch.spec.whatwg.org/#http-whitespace-byte URL
- https://infra.spec.whatwg.org/#byte-sequence URL
- https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49799... Vendor Advisory
- https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-49799 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published8 Dec 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta