### Impact
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers.

### Patches
The issue was fixed in `[email protected]`.

### Workarounds
Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: "127.0.0.1"` option.

### References
- https://github.com/cloudflare/workers-sdk/pull/4532

Affected Packages

npm miniflare

Affected versions: 3.20230821.0 (fixed in 3.20231030.2)

Related CVEs

CVE-2023-7078

Key Information

GHSA ID

GHSA-fwvg-2739-22v7

Published

December 29, 2023 7:36 PM

Last Modified

December 29, 2023 7:36 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

miniflare

GitHub Reviewed

✓ Yes

Dataset

Last updated: November 25, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.