CVE-2025-55152: Oak Middleware Framework DoS Vulnerability

CVE-2025-55152 Overview

CVE-2025-55152 is a Regular Expression Denial of Service (ReDoS) vulnerability in oak, a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers, and Bun. Versions 17.1.5 and below are affected. Attackers can significantly slow down an oak server by sending specially crafted values in the x-forwarded-proto or x-forwarded-for HTTP headers. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and impacts service availability without requiring authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can degrade oak server performance by transmitting crafted forwarded-header values that trigger catastrophic regex backtracking.

Affected Products

oak middleware framework versions 17.1.5 and below
Deno, Deno Deploy, Node.js 16.5+, Cloudflare Workers, and Bun applications using vulnerable oak versions
HTTP services relying on oak's proxy header parsing (x-forwarded-for, x-forwarded-proto)

Discovery Timeline

2025-08-09 - CVE-2025-55152 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55152

Vulnerability Analysis

The vulnerability resides in oak's request-handling logic that parses proxy forwarding headers. When the framework operates behind a proxy, it reads the x-forwarded-for header and splits the value into an array of IP addresses. The original implementation used the regular expression /\s*,\s*/ on unbounded input, which allowed adversaries to submit arbitrarily long header values containing patterns that force expensive backtracking. Repeated requests amplify the impact and consume CPU resources on the server. The result is degraded response time and reduced availability for legitimate clients. This weakness is a textbook algorithmic complexity attack against a network-facing middleware component.

Root Cause

The root cause is unbounded input handling combined with a regex-based split on user-controlled header data. Because HTTP headers can be arbitrarily large and are attacker-controlled, applying a regex with whitespace quantifiers across the entire value creates worst-case runtime behavior proportional to the input length.

Attack Vector

An attacker sends HTTP requests to an oak-based service with maliciously crafted x-forwarded-for or x-forwarded-proto header values. No authentication, privileges, or user interaction is required. The attack is fully remote over the network and can be repeated to sustain a denial-of-service condition.

typescript

// Security patch in request.ts — fix: address ReDoS vulnerability in headers (#700)
// * `X-Forwarded-For`. When `false` an empty array is returned.
get ips(): string[] {
  return this.#proxy
    ? (() => {
      const raw = this.#serverRequest.headers.get("x-forwarded-for") ??
        this.#getRemoteAddr();
      const bounded = raw.length > 4096 ? raw.slice(0, 4096) : raw;
      return bounded
        .split(",", 100)
        .map((part) => part.trim())
        .filter((part) => part.length > 0);
    })()
    : [];
}
// Source: https://github.com/oakserver/oak/commit/b60e60330ef227707c4dc13ef0ea36192d894f44

The patch replaces the regex-based split with a bounded, length-limited approach. Input is truncated to 4096 characters, split on a plain , delimiter capped at 100 parts, and each element is trimmed and filtered. This eliminates the backtracking path and enforces upper bounds on parsing work.

Detection Methods for CVE-2025-55152

Indicators of Compromise

Inbound HTTP requests containing unusually long x-forwarded-for or x-forwarded-proto header values
Header values with large numbers of whitespace-separated or comma-separated tokens designed to trigger regex backtracking
Sustained CPU utilization spikes on oak server processes correlated with specific client source addresses

Detection Strategies

Inspect reverse proxy or web application firewall logs for oversized forwarded headers and flag values exceeding 4096 bytes
Correlate spikes in Node.js, Deno, or Bun runtime CPU consumption with request patterns targeting middleware endpoints
Monitor request latency percentiles per route and alert on sudden increases affecting oak-served endpoints

Monitoring Recommendations

Enable structured logging of forwarded headers at the edge and retain samples for forensic review
Set rate-limiting alerts on repeated requests from single source IPs carrying anomalous header sizes
Track application performance metrics such as event-loop lag and per-request CPU time to surface algorithmic complexity abuse

How to Mitigate CVE-2025-55152

Immediate Actions Required

Upgrade oak to a version above 17.1.5 that includes commit b60e603 containing the patched ips getter
Audit all Deno, Node.js, Cloudflare Workers, and Bun deployments that depend on oak and inventory affected services
Deploy WAF or reverse-proxy rules to reject requests with x-forwarded-for or x-forwarded-proto values exceeding a reasonable length threshold

Patch Information

The fix is available in the GitHub Security Advisory GHSA-r3v7-pc4g-7xp9 and applied via the GitHub commit b60e603. The patch bounds the header input to 4096 characters and caps the number of parsed tokens to 100 using a plain-string split.

Workarounds

Terminate proxy header parsing at an upstream layer such as NGINX or a CDN and strip or sanitize incoming x-forwarded-* headers before forwarding to oak
Enforce request header size limits at the load balancer to drop oversized forwarded headers before they reach the application
Disable the proxy option in oak applications that do not run behind a trusted proxy, preventing the vulnerable code path from executing

bash

# NGINX example: bound forwarded header size and enforce sane request limits
large_client_header_buffers 4 8k;
client_header_buffer_size 4k;

# Strip or override attacker-controlled forwarded headers before proxying
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;