zoraxy vulnerabilities
CVEs whose affected-version data names the zoraxy package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108899High· 7.3PoCA flaw has been found in tobychui zoraxy up to 3.3.4
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes im…
▾ Midnighttobychui · zoraxyEPSS 0.45%via NVD
CVE-2026-100390High· 7.4Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their s…
▾ Twilighttobychui · zoraxyEPSS 0.29%via NVD