CVE-2026-50288: SpecifyJS Auth Bypass Vulnerability

CVE-2026-50288 Overview

CVE-2026-50288 is a Server-Side Request Forgery (SSRF) vulnerability in SpecifyJS, a declarative TypeScript user interface framework. Versions prior to 0.2.136 contain a flaw in the assertSecureUrl function. When new URL() throws a parse error, the function returns silently instead of throwing, allowing requests to bypass HTTPS validation. The maintainer released version 0.2.136 to correct the control flow by throwing an error inside the catch block. This weakness is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Attackers can supply malformed URLs that bypass HTTPS enforcement, enabling unencrypted or attacker-controlled requests to be issued by the application.

Affected Products

SpecifyJS versions prior to 0.2.136
Applications embedding the asymmetric-effort/specifyjs package
TypeScript projects relying on assertSecureUrl for transport validation

Discovery Timeline

2026-08-21 - CVE-2026-50288 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-50288

Vulnerability Analysis

The defect resides in the assertSecureUrl helper used by SpecifyJS to enforce HTTPS transport before issuing outbound requests. The function wraps new URL(input) in a try/catch. When parsing fails, the catch block returns without raising an exception. Callers interpret the absence of an error as a successful validation and continue to dispatch the request.

Because validation is skipped for malformed inputs, an attacker who controls URL data reaching the framework can craft strings that fail parsing yet still trigger downstream fetch logic. The result is a bypass of the HTTPS-only guarantee that consumers depend on, exposing the application to SSRF and cleartext traffic exposure.

The patch in version 0.2.136 replaces the silent return with an explicit throw, ensuring parse errors propagate to callers and abort the request pipeline.

Root Cause

The root cause is a fail-open error handler. Defensive validation must default to rejection, but assertSecureUrl treated a parse exception as an implicit pass. This pattern violates secure-by-default input validation and produces inconsistent semantics between valid HTTP URLs (rejected) and invalid URLs (accepted).

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker submits a malformed URL to any code path that reaches assertSecureUrl. The function returns without throwing, and the caller proceeds to issue the outbound request. Depending on the calling context, this can lead to internal service reachability, credential leakage over cleartext, or interaction with attacker-hosted endpoints.

typescript

// Related hardening from the v0.2.136 patch (core/src/client/graphql.ts)
// Source: https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a
if (/[{}():]/.test(val)) {
  throw new Error(
    `[SpecifyJS] gql: Interpolated value "${val}" contains GraphQL metacharacters ({, }, (, ), :). ` +
      'Use the variables parameter instead of string interpolation to prevent injection.',
  );
}

Detection Methods for CVE-2026-50288

Indicators of Compromise

Outbound HTTP (non-TLS) connections originating from SpecifyJS-based services that normally use HTTPS.
Application logs showing requests to malformed or unexpected hostnames dispatched without validation errors.
Requests to internal IP ranges (RFC1918, link-local 169.254.0.0/16, or metadata endpoints such as 169.254.169.254) from application processes.

Detection Strategies

Inventory dependencies and flag any application manifest referencing specifyjs at a version below 0.2.136.
Add runtime egress monitoring that alerts on cleartext HTTP requests from services expected to communicate only over TLS.
Instrument the assertSecureUrl call path with logging to capture inputs that previously would have been silently accepted.

Monitoring Recommendations

Correlate web application logs with proxy or firewall egress logs to identify protocol downgrades.
Alert on outbound requests from application workloads to cloud metadata services or private address space.
Track dependency drift in CI/CD to prevent regression to vulnerable SpecifyJS builds.

How to Mitigate CVE-2026-50288

Immediate Actions Required

Upgrade SpecifyJS to version 0.2.136 or later across all environments.
Audit application code for any custom wrappers around assertSecureUrl that may replicate the fail-open pattern.
Restrict outbound network egress from application workloads to an allowlist of required destinations.

Patch Information

The fix ships in SpecifyJS v0.2.136 and is tracked in GitHub Security Advisory GHSA-8882-frvv-92w4. The corrective commit is available in the upstream commit note, which replaces the silent return in the catch block with an explicit throw and hardens related GraphQL and CSS handling.

Workarounds

Wrap URL inputs in an explicit new URL() validation before invoking SpecifyJS request helpers and reject on any exception.
Enforce HTTPS at the network layer using an egress proxy that blocks plaintext HTTP from application workloads.
Deny outbound traffic to metadata and internal ranges via host or cloud firewall policies until the patched version is deployed.

bash

# Upgrade to the patched release
npm install specifyjs@0.2.136
# Or with pnpm
pnpm add specifyjs@0.2.136
# Verify installed version
npm ls specifyjs