GitHub Advisoryadvisory · npm

GHSA-w789-49fc-v8hr TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

HIGH Published 2026-02-26 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-27818
Ecosystem
npm
Packages
terriajs-server
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-918
Reviewed
2026-02-26

Affected packages

• npm terriajs-server: < 4.0.3 → fixed in 4.0.3

Description

Impact A validation bug allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. The validation only checks if a hostname _ended_ with an allowed domain. This meant: If `example.com` is allowed in `proxyableDomains`: • ✅ example.com is allowed (correct) • ✅ api.example.com is allowed (correct) • ⚠️ maliciousexample.com is allowed (incorrect) An attacker could register maliciousexample.com and proxy content through `terriajs-server`, bypassing proxy restrictions. Patches All versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-27818 TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-918 Server-Side Request Forgery weakness

References