Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cloudflare/workers-sdk

              main @ f808554
            

Fixes

CVEs

HIGH

Peak severity

43.8%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

dependency: most-fixed (4 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes in the Miniflare local explorer address host/origin validation gaps that allow unauthorized access to internal APIs. The pattern of validating headers only after rewriting or only for certain routes is error-prone.

SSRF: The Miniflare proxy server lacked host validation and secret checks, allowing SSRF to internal services. A sibling fix added a required secret header, indicating the proxy was previously unauthenticated.

Information Disclosure: OAuth credentials file was written with default permissions, allowing other local users to read tokens. The fix enforces 0600 mode on creation and every save, a classic local file permission issue.