Description
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Portkey-AI | gateway | < 1.14.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @portkey-ai/gateway | < 1.14.0 | 1.14.0 | GHSA-hhh5-2cvx-vmfp |