| Version | Supported | Support Status |
|---|---|---|
| 4.x | ✅ | Active |
| 3.x | ✅ | Security fixes only, until February 7, 2027 |
| 2.x | ✅ | Security fixes only, until February 7, 2027 |
| 1.x | ❌ | Not supported (end of life) since April 18, 2024 |
| 0.x | ❌ | Not supported (end of life) since January 7, 2024 |
| Affected | Description | Severity | Vulnerability Type | Fixed in |
|---|---|---|---|---|
| ≤ 4.0.1, ≤ 3.4.3, ≤ 2.2.9 | Proxy paths climb out of the endpoint's base URL path with its credentials. Read more | Moderate (6.5) | CWE-22 | 4.1.0, 3.4.4, 2.2.10 |
| ≤ 4.0.0, ≤ 3.4.2, ≤ 2.2.8 | SSRF & credentials leak through a path the fetch layer reads as absolute. Read more | High (8.6) | CWE-918 | 4.0.1, 3.4.3, 2.2.9 |
| ≤ 0.21.3 | SSRF & credentials leak. Read more | High (7.5) | CWE-918 | 0.22.0 |
| ≤ 0.21.3 | DoS by abusing fetchOptions.retry. Read more |
High (7.5) | CWE-674 | 0.22.0 |
| ≤ 0.12.0 | Leak secret tokens by changing baseURL. Read more |
High (7.5) | CWE-840 | 0.13.0 |
To report a vulnerability, draft a new security advisory. Please include the affected version and a request that reproduces the issue against a local backend.