Skip to content

v4.5.8
Compare
Choose a tag to compare
@yusukebe yusukebe released this 22 Aug 07:14
· 43 commits to main since this release
v4.5.8
d1c7f6f

Security Fix for CSRF Protection Middleware

Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including Content-Types with uppercase letters (e.g., Application/x-www-form-urlencoded) as potential attacks, allowing them to pass.

This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately.

For more details, see the report here: GHSA-rpfr-3m35-5vx5

Assets 2
Loading