Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
improbable-eng/grpc-web
master @ 1d9bbb0
4
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Denial of Service: 2 prior fixes. Scrutinize any change in this area.
go/grpcweb: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Unrestricted WebSocket message payloads allow malicious clients to consume excessive memory resources, leading to server exhaustion. Developers must enforce strict read limits on 'nhooyr.io/websocket.Conn' objects.
Auth Bypass: Permissive CORS policies allowed any external origin to interact with the gRPC endpoints, exposing APIs to unauthorized cross-origin requests. Implementing default-deny cross-origin behaviors in 'ServeHTTP' is necessary to mitigate this threat.
Denial of Service: The lack of an explicit maximum receive message size configuration on the gRPC proxy server allowed large network packets to crash the server due to resource exhaustion. Enforcing gRPC payload limit parameters is vital.