Description
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
Remediation
References
https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7
Related Vulnerabilities
CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common
CVE-2021-39149 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-8823 Vulnerability in npm package sockjs
CVE-2021-25646 Vulnerability in maven package org.apache.druid:druid-core
CVE-2021-31405 Vulnerability in maven package com.vaadin:vaadin-text-field-flow