Skip to content

v3.66.2 — security hardening: bearer parsing, verification codes, protocol stripping

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 31 Oct 18:20
· 23 commits to main since this release
v3.66.2
bd77bce
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch: @claude-flow/cli, claude-flow, ruflo 3.66.2, with the bundled @claude-flow/mcp 3.1.5 and @claude-flow/security 3.0.6 (also published standalone).

Security

  • Bearer tokens are parsed in linear time (@claude-flow/mcp). The HTTP and WebSocket transports matched Authorization with /^Bearer\s+(.+)$/i. That pattern backtracks quadratically on a long run of whitespace followed by a line break (CodeQL js/polynomial-redos). Node's HTTP parser already rejects line breaks in header values, so this is hardening rather than a reachable denial of service. Both transports now use a prefix compare and trimStart, and refuse headers over 8 KB.
  • Verification codes are uniform (@claude-flow/security). TokenGenerator.generateVerificationCode() used byte % 10, so digits 0-5 came up 26/256 of the time and 6-9 only 25/256. Each digit now comes from crypto.randomInt(10).
  • sanitizeString cannot be tricked into rebuilding a protocol (@claude-flow/security). One pass turned javajavascript:script: into javascript:. It now strips javascript:, vbscript: and data: until none remain.
  • terminal_create session ids come from crypto.randomBytes rather than Math.random.

PR: #4624. Follow-up for the dependency tree: #4625.

Assets 2
Loading