Description
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
Remediation
References
https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7
Related Vulnerabilities
CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-standard-processors
CVE-2020-15256 Vulnerability in maven package org.webjars.npm:object-path
CVE-2021-23700 Vulnerability in npm package merge-deep2
CVE-2021-3765 Vulnerability in npm package validator
CVE-2022-25898 Vulnerability in maven package org.webjars.bower:jsrsasign