CVE-2024-49770

`oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For an attacker this has potential to read sensitive user data or to gain access to server secrets. Version 17.1.3 fixes the issue.

• CWE-22
• CWE-35

• https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125
• https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25
• https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209
• https://github.com/oakserver/oak/security/advisories/GHSA-qm92-93fv-vh7m

Published

Nov 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49765Discourse is an open source platform for community discussio…9.1
• CVE-2024-49766Werkzeug is a Web Server Gateway Interface web application l…5.3
• CVE-2024-49767Werkzeug is a Web Server Gateway Interface web application l…7.5
• CVE-2024-49768Waitress is a Web Server Gateway Interface server for Python…4.8
• CVE-2024-49769Waitress is a Web Server Gateway Interface server for Python…7.5
• CVE-2024-4977The Index WP MySQL For Speed WordPress plugin before 1.4.18 …6.8
• CVE-2024-49771MPXJ is an open source library to read and write project pla…5.3
• CVE-2024-49772SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2024-49773SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2024-49774SuiteCRM is an open-source, enterprise-ready Customer Relati…7.2
• CVE-2024-49775A vulnerability has been identified in Opcenter Execution Fo…9.8
• CVE-2024-49776A negative-size-param in tsMuxer version nightly-2024-04-05-…6.5