Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
specklesystems/speckle-server
main @ 51d43b9
156
Fixes
0
CVEs
CRITICAL
Peak severity
18.9%
Coverage
Highlights
Auth Bypass: 89 prior fixes. Scrutinize any change in this area.
packages/server/modules/core/rest/upload.js: most-fixed (8 issues). Treat as high-risk during review.
83 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A critical self-comparison logic flaw in the authentication code handshake allowed authorization checks to be short-circuited, leading to absolute bypass of automation credentials.
Auth Bypass: The validateScopes helper failed to return a Promise, causing callers to proceed without waiting for the asynchronous authorization check to complete, allowing unauthenticated requests to pass.
Denial of Service: Dangling stream event listeners when network connections closed prematurely leaked database connections, leading to resource exhaustion and eventual server-wide denial of service.