com.vaadin:flow-server 24.9.0-beta1

Direct Vulnerabilities

Known vulnerabilities in the com.vaadin:flow-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Permissive Cross-domain Policy with Untrusted Domains Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the `push endpoint` reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by making cross-origin requests with the user's cookies and reading the response. This is only exploitable if the application uses server push and the attacker knows the push identifier of the session. How to fix Permissive Cross-domain Policy with Untrusted Domains? Upgrade `com.vaadin:flow-server` to version 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4 or higher.	[2.13.0,2.13.8)[23.6.0,23.6.16)[24.4.0,24.4.19)[24.5.0,24.7.17)[24.8.0,24.9.29)[24.10.0,24.10.15)[25.0.0,25.1.19)[25.2.0,25.2.13)[25.3.0,25.3.4)
L Directory Traversal Affected versions of this package are vulnerable to Directory Traversal via the `extractZipArchive()` function when downloading and extracting Node.js archives. An attacker can create or modify files outside the intended extraction directory by intercepting or controlling the Node.js download and serving a specially crafted ZIP archive containing path traversal sequences. Note: This is only exploitable if the system does not have a compatible Node.js version preinstalled globally, allowing the build process to automatically download and extract Node.js. How to fix Directory Traversal? Upgrade `com.vaadin:flow-server` to version 2.13.1, 23.6.8, 24.9.10 or higher.	[2.0.0,2.13.1)[3.0.0,23.6.8)[24.0.0,24.9.10)
M Access Control Bypass Affected versions of this package are vulnerable to Access Control Bypass due to inconsistent path pattern matching of reserved framework paths. An attacker can create unauthorized sessions and trigger framework initialization by accessing the `/VAADIN` endpoint without a trailing slash, thereby bypassing security filters. How to fix Access Control Bypass? Upgrade `com.vaadin:flow-server` to version 23.6.7, 24.9.8, 25.0.2 or higher.	[23.0.0,23.6.7)[24.0.0,24.9.8)[25.0.0-beta1,25.0.2)

Vulnerability

Vulnerable Version

Permissive Cross-domain Policy with Untrusted Domains

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by making cross-origin requests with the user's cookies and reading the response. This is only exploitable if the application uses server push and the attacker knows the push identifier of the session.

How to fix Permissive Cross-domain Policy with Untrusted Domains?

Upgrade com.vaadin:flow-server to version 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4 or higher.

[2.13.0,2.13.8)[23.6.0,23.6.16)[24.4.0,24.4.19)[24.5.0,24.7.17)[24.8.0,24.9.29)[24.10.0,24.10.15)[25.0.0,25.1.19)[25.2.0,25.2.13)[25.3.0,25.3.4)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the extractZipArchive() function when downloading and extracting Node.js archives. An attacker can create or modify files outside the intended extraction directory by intercepting or controlling the Node.js download and serving a specially crafted ZIP archive containing path traversal sequences.

Note:

This is only exploitable if the system does not have a compatible Node.js version preinstalled globally, allowing the build process to automatically download and extract Node.js.

How to fix Directory Traversal?

Upgrade com.vaadin:flow-server to version 2.13.1, 23.6.8, 24.9.10 or higher.

[2.0.0,2.13.1)[3.0.0,23.6.8)[24.0.0,24.9.10)

Access Control Bypass

Affected versions of this package are vulnerable to Access Control Bypass due to inconsistent path pattern matching of reserved framework paths. An attacker can create unauthorized sessions and trigger framework initialization by accessing the /VAADIN endpoint without a trailing slash, thereby bypassing security filters.

How to fix Access Control Bypass?

Upgrade com.vaadin:flow-server to version 23.6.7, 24.9.8, 25.0.2 or higher.

[23.0.0,23.6.7)[24.0.0,24.9.8)[25.0.0-beta1,25.0.2)

com.vaadin:flow-server@24.9.0-beta1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically