Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fatedier/frp

              dev @ 14628df
            

Fixes

CVEs

HIGH

Peak severity

32.0%

Coverage

Highlights

Denial of Service: 10 prior fixes. Scrutinize any change in this area.

client/proxy.go: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inconsistent processing of Proxy-Authorization credentials in HTTP vhost routing path allows bypasses when routeByHTTPUser is enabled. Developers should ensure proxy credentials are systematically authenticated.

Denial of Service: Lack of non-zero ReadHeaderTimeout values on HTTP/HTTPS plugin servers allows slowloris-style header exhaustion attacks. Developers must always configure explicit server timeouts.

Authentication Bypass: Discrepancies in configuration flags (such as AuthenticateHeartBeats vs AuthenticateNewWorkConns) can cause work connections to bypass authentication checks altogether.