Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dunglas/mercure

              main @ 5d71d99
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

publish: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Ignoring verification errors returned during JWT signature validation allowed unauthenticated clients to claim arbitrary subscription targets. Always check error returns immediately before utilizing parsed token structures.

Cache Poisoning: Concatenating string fields with underscore separators created structural ambiguity (key collisions), which allowed unauthorized users to bypass subscriptions or poison state. Use strongly typed, non-stringified composite structures or safe serialization for cache keys.

Auth Bypass: Using full request URLs rather than strictly parsed request paths (RequestURI) led to routing and selector authorization mismatches, letting clients access unauthorized topics. Ensure consistency in path extraction logic.