Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

portkey-ai/gateway

              main @ 669825c
            

Fixes

CVEs

CRITICAL

Peak severity

35.7%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

src/middlewares/requestValidator/index.ts: most-fixed (6 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Attackers can bypass basic host string checks to perform arbitrary internal requests (as illustrated by CVE-2025-66405). Bypasses occurred using alternative IP formats, Cloud Metadata hosts, and incorrect evaluation of string indices.

Auth Bypass: Unauthenticated access was possible to the admin interface and static UI routing when configuration flags or token checks (such as admin_token) were omitted or parsed incorrectly.

Denial of Service: Uncaught TypeErrors and application crashes occur during request parsing when mandatory headers like Content-Type are missing or malformed, triggering uncaught exceptions in string manipulations.