CVE-2022-24822

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.

• CWE-248

• https://github.com/podium-lib/layout/commit/fe43e655432b0a5f07b6475f67babcc2588fb039Patch, Third Party Advisory
• https://github.com/podium-lib/layout/releases/tag/v4.6.110Release Notes, Third Party Advisory
• https://github.com/podium-lib/proxy/commit/9698a40df081217ce142d4de71f929baaa339cdfPatch, Third Party Advisory
• https://github.com/podium-lib/proxy/releases/tag/v4.2.74Release Notes, Third Party Advisory
• https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrwThird Party Advisory
• https://github.com/podium-lib/layout/commit/fe43e655432b0a5f07b6475f67babcc2588fb039Patch, Third Party Advisory
• https://github.com/podium-lib/layout/releases/tag/v4.6.110Release Notes, Third Party Advisory
• https://github.com/podium-lib/proxy/commit/9698a40df081217ce142d4de71f929baaa339cdfPatch, Third Party Advisory
• https://github.com/podium-lib/proxy/releases/tag/v4.2.74Release Notes, Third Party Advisory
• https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrwThird Party Advisory

Published

Apr 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24817Flux2 is an open and extensible continuous delivery solution…9.9
• CVE-2022-24818GeoTools is an open source Java library that provides tools …7.2
• CVE-2022-24819XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2022-2482 A vulnerability exists in Nokia’s ASIK AirScale system modu…8.8
• CVE-2022-24820XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2022-24821XWiki Platform is a generic wiki platform offering runtime s…8.1
• CVE-2022-24823Netty is an open-source, asynchronous event-driven network a…5.5
• CVE-2022-24824Discourse is an open source platform for community discussio…5.3
• CVE-2022-24825Smokescreen is a simple HTTP proxy that fogs over naughty UR…5.3
• CVE-2022-24826On Windows, if Git LFS operates on a malicious repository wi…7.8
• CVE-2022-24827Elide is a Java library that lets you stand up a GraphQL/JSO…8.1
• CVE-2022-24828Composer is a dependency manager for the PHP programming lan…8.8