Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nelmio/nelmiocorsbundle
master @ 3d80dbc
7
Fixes
0
CVEs
HIGH
Peak severity
85.7%
Coverage
Highlights
CORS Misconfiguration: 4 prior fixes. Scrutinize any change in this area.
EventListener/CorsListener.php: most-fixed (7 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
CORS Misconfiguration: The application historically reflected incoming Origin headers blindly when all origins were allowed, leading to illegal configurations that enabled credentialed cross-origin access (e.g., when allow_credentials was set to true).
Auth Bypass: Bypasses in origin validation occurred when comparing the raw request Origin directly to the allowed origin configuration list without sanitizing protocol schemes (http/https).
Reflected XSS: Rendering unescaped, unauthorized header names directly into CORS error responses allowed attackers to execute script payloads in the victim's browser context.