Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nymtech/nym-vpn-client

              develop @ 18c6d86
            

Fixes

CVEs

HIGH

Peak severity

30.8%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

nym-ipc: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: QUIC sockets could leak or bypass the VPN firewall on Android and Linux if raw socket file descriptors are not registered with appropriate bypass/firewall marking during creation.

Broken Cryptography: Improper TLS certificate and CRL validation issues occurred on Android due to platforms relying on platform-specific verifiers rather than a robust, standalone trust store.

Auth Bypass: The lack of mandatory authentication on Unix Domain Sockets allowed unauthorized local client processes to interact directly with the privileged VPN daemon.