blaze-server HTTP/1.1 Trailer Field Vulnerability: Early Warning
An early warning has been issued regarding a potential vulnerability in the blaze-server npm package. Reportedly, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers, enabling an unauthenticated remote client to inject arbitrary header names and values that a fronting proxy sanitized from the request-header section. This could bypass header-based trust decisions in the application.
What happened
According to the reported vulnerability, blaze-server appears to improperly handle HTTP/1.1 chunked-body trailer fields by merging them into the Request.headers. Since trailer fields are attacker-controlled, this could allow an unauthenticated remote client to inject headers that a fronting proxy has sanitized, potentially bypassing security measures that rely on header sanitization.
The vulnerability is under investigation, and it is recommended that users deploy blaze-server behind a proxy that removes trailer fields or rejects requests that use trailers before forwarding them. Until a patch is available, it is advised to avoid making trust decisions based on headers that a proxy is relied upon to sanitize.
For more detailed information, primary sources should be consulted. The affected component is the blaze npm package. The GitHub Security Advisory GHSA-46q4-43ph-c6fr provides further details on this issue.
How 0Day mitigates this
blaze is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.