8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27818

CVE-2026-27818: TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the proxyableDomains configuration. Version 4.0.3 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27818

CVE-2026-27818:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
terriajs-server	npm	< 4.0.3	4.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the isProxyable function within lib/controllers/proxy.js. The function was intended to check if a requested hostname is present in the proxyableDomains list. However, the implementation was flawed. It only checked if the hostname ended with an allowed domain string, rather than checking for an exact match or a subdomain match. This flaw is evident in the patch, which replaces the incorrect check (host.indexOf(proxyDomains[i], host.length - proxyDomains[i].length) !== -1) with a much stricter check (host === domainLower || host.endsWith("." + domainLower)). An attacker could exploit this by registering a domain that ends with an allowed domain name (e.g., maliciousexample.com when example.com is allowed), thus bypassing the proxy's security controls and potentially leading to Server-Side Request Forgery (SSRF). The vulnerable function isProxyable is the central point of this vulnerability, as it is responsible for making the faulty security decision.

Vulnerable functions

isProxyable

lib/controllers/proxy.js

The function `isProxyable` in `lib/controllers/proxy.js` is vulnerable to a domain validation bypass. The original code checked if a hostname ended with an allowed domain. This allowed an attacker to register a domain like `maliciousexample.com` and have it be allowed if `example.com` was in the allowlist, because `maliciousexample.com` ends with `example.com`. The vulnerable code snippet `host.indexOf(proxyDomains[i], host.length - proxyDomains[i].length) !== -1` incorrectly validates the domain, leading to an SSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.