CVE-2025-4727: Meteor Affected By Inefficient Regular Expression Complexity

The vulnerability description explicitly mentions that the issue affects Object.assign in packages/ddp-server/livedata_server.js due to the manipulation of the forwardedFor argument leading to inefficient regular expression complexity. The provided commit f7ea6817b90952baaea9baace2a3b4366fee6a63 shows changes in this exact file. The diff in packages/ddp-server/livedata_server.js modifies how the forwardedFor string (obtained from self.socket.headers["x-forwarded-for"]) is processed. The line - forwardedFor = forwardedFor.trim().split(/\s*,\s*/); is replaced by + forwardedFor = forwardedFor.split(','); and a subsequent map operation for trimming. This change is within a block starting with Object.assign(Session.prototype, {, and the surrounding code indicates this is part of the _clientAddress method of the Session object. The removal of the regular expression (/\s*,\s*/) directly addresses the described vulnerability. Therefore, Session.prototype._clientAddress is the function that contained the vulnerable code.