## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With `base: "/app"`, a request to `/appX/admin` was treated as being under the base and resolved internally to the `/admin` route, while middleware still observed the public pathname `/appX/admin`. Middleware that authorizes routes by inspecting `conte

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that author

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that author

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network.

A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issu

CVE-2026-14687 影响 666ghj BettaFish 版本 1.2.1 及之前版本。该漏洞位于 InsightEngine 组件的 agent.py 文件中的 _deduplicate_results 函数，用于搜索结果的去重处理。该函数在处理数据时存在部分字符串比较漏洞，攻击者可以通过远程发送特制的请求，利用此漏洞绕过预期的完整字符串匹配逻辑，导致不完整的比较结果。虽然该漏洞的 CVSS 评分仅为 5.3（中等），但攻击复杂度低（无需权限或用户交互），且漏洞细节及利用代码已被公开披露，增大了被实际利用的风险。目前厂商已有修复该问题的拉取请求（pull request）正在等待合并，建议用户关注官方更新并在补丁可用后立即应用。在补丁应用前，可通过限制对受影响服务的网络访问（如将服务部署在内网或使用防火墙）来降低风险。该漏洞被归类为输入验证不足导致的逻辑缺陷，攻击者可能利用它操纵查询结果，但暂未发现已被在野利用的证据。

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+pat

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. Th