GitHub Advisoryadvisory · npm

GHSA-663h-2vr3-ghrj yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

HIGH Published 2026-02-23 Modified 2026-02-25 Official page ↗
Aliases
CVE-2025-70058
Ecosystem
npm
Packages
yapi-vendor
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-02-25

Affected packages

• npm yapi-vendor: <= 1.12.0 (no fix yet)

Description

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests

Related

Alias · CVE (1)

  • CVE-2025-70058 An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References