Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

expressjs/cors

              master @ 5317ebe
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

CORS Misconfiguration: 3 prior fixes. Scrutinize any change in this area.

lib/index.js: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CORS Misconfiguration: Shared configuration options could be mutated across requests, allowing unauthorized subsequent requests to inherit previously validated origins and bypass CORS restrictions.

CORS Misconfiguration: Failing to set the 'Vary: Origin' header when specific non-wildcard origins are allowed can cause downstream caches to serve incorrect CORS headers to unauthorized clients.

CORS Misconfiguration: Non-normalized HTTP method names can fail preflight request detection, leading to inconsistent CORS policy application for non-uppercase OPTIONS requests.