CVE-2023-49799

`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.

• CWE-918

• https://fetch.spec.whatwg.org/Not Applicable
• https://fetch.spec.whatwg.org/#http-whitespace-byteNot Applicable
• https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31Issue Tracking
• https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxvExploit, Mitigation, Vendor Advisory
• https://infra.spec.whatwg.org/#byte-sequenceNot Applicable
• https://fetch.spec.whatwg.org/Not Applicable
• https://fetch.spec.whatwg.org/#http-whitespace-byteNot Applicable
• https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31Issue Tracking
• https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxvExploit, Mitigation, Vendor Advisory
• https://infra.spec.whatwg.org/#byte-sequenceNot Applicable

Published

Dec 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49793CodeChecker is an analyzer tooling, defect database and view…6.5
• CVE-2023-49794KernelSU is a Kernel-based root solution for Android devices…7.8
• CVE-2023-49795MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49796MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49797PyInstaller bundles a Python application and all its depende…7.8
• CVE-2023-49798OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2023-4980Cross-site Scripting (XSS) - Generic in GitHub repository li…5.4
• CVE-2023-49800`nuxt-api-party` is an open source module to proxy API reque…7.5
• CVE-2023-49801Lif Auth Server is a server for validating logins, managing …7.5
• CVE-2023-49802The LinkedCustomFields plugin for MantisBT allows users to l…6.1
• CVE-2023-49803@koa/cors npm provides Cross-Origin Resource Sharing (CORS) …7.5
• CVE-2023-49804Uptime Kuma is an easy-to-use self-hosted monitoring tool. P…7.8