VYPR
← All advisories
High severityNVD Advisory· Published Feb 26, 2026· Updated Feb 26, 2026

TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

CVE-2026-27818

Description

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the proxyableDomains configuration. Version 4.0.3 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
terriajs-servernpm
< 4.0.34.0.3

Affected products

1

Patches

1
3aaa5d971716

fix(proxy): allow only exact domain or subdomains to be considered valid host

https://github.com/TerriaJS/terriajs-serverZoran KokezaDec 2, 2025via ghsa
commit
1 file changed · +2 −2
  • lib/controllers/proxy.js+2 −2 modified
    @@ -94,9 +94,9 @@ module.exports = function (options) {
     host = host.toLowerCase();
     //check that host is from one of these domains
     for (var i = 0; i < proxyDomains.length; i++) {
+      const domainLower = proxyDomains[i].toLowerCase();
       if (
-        host.indexOf(proxyDomains[i], host.length - proxyDomains[i].length) !==
-        -1
+        host === domainLower || host.endsWith("." + domainLower)
       ) {
         return true;
       }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.