CVE-2025-70058: 
JavaScript vulnerability analysis and mitigation

CVE-2025-70058 is an Improper Certificate Validation vulnerability (CWE-295) affecting YMFE YApi v1.12.0, a self-deployable visual API management platform. The application disables TLS/SSL certificate validation by setting rejectUnauthorized: false in the HTTPS agent configuration for Axios requests, enabling man-in-the-middle (MitM) attacks. The vulnerability was disclosed on February 23, 2026, with the GitHub Gist report created on February 11, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (Feedly, GitHub Gist).

The root cause is classified as CWE-295 (Improper Certificate Validation). YApi v1.12.0 explicitly sets rejectUnauthorized: false in its HTTPS agent configuration when making outbound Axios requests, which instructs Node.js to skip TLS/SSL certificate chain and hostname verification entirely. This means any HTTPS connection initiated by the application — such as those used for API testing or data import — will proceed even if the server presents an invalid, self-signed, or attacker-controlled certificate. No authentication or special privileges are required to position an attacker for exploitation, though the attack complexity is rated High due to the requirement for a network-adjacent or on-path position (GitHub Gist, Feedly).

Successful exploitation allows a network-adjacent attacker to perform man-in-the-middle attacks against YApi's outbound HTTPS connections, enabling interception and modification of sensitive data in transit. The CVSS assessment indicates high confidentiality and integrity impact, meaning attackers can both read and tamper with API request/response data, credentials, or tokens exchanged between YApi and backend services. Availability is not directly impacted, but the exposure of API secrets or authentication tokens could facilitate further compromise of connected systems (Feedly, GitHub Gist).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-70058. The EPSS score is extremely low at 0.01%, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to be in a network-on-path (MitM) position, which raises the practical attack complexity (Feedly).

1. Reconnaissance: Identify a target YApi v1.12.0 instance that makes outbound HTTPS requests (e.g., for API testing, Swagger import, or webhook callbacks) on a network segment accessible to the attacker.
2. Network Positioning: Position the attacker's system as a man-in-the-middle on the network path between the YApi server and its HTTPS targets, using techniques such as ARP spoofing, DNS poisoning, or rogue Wi-Fi access points.
3. TLS Interception: Deploy a TLS-intercepting proxy (e.g., mitmproxy, Burp Suite) with a self-signed or attacker-controlled certificate. Because YApi sets rejectUnauthorized: false, the Axios HTTPS agent will accept any certificate without validation.
4. Intercept/Modify Traffic: Capture plaintext API requests and responses passing through the proxy, including any authentication tokens, API keys, or sensitive payload data transmitted by YApi to backend services.
5. Leverage Captured Data: Use intercepted credentials or tokens to authenticate to backend APIs or pivot to other systems (GitHub Gist, Feedly).

• Network: Unexpected TLS handshakes from the YApi server to IP addresses presenting self-signed or untrusted certificates; unusual outbound HTTPS connections to unfamiliar endpoints; duplicate or anomalous ARP entries on the network segment hosting YApi.
• Logs: YApi application logs showing successful HTTPS connections to endpoints with certificate errors that would normally be rejected; Node.js process logs lacking TLS certificate validation warnings despite connecting to unrecognized hosts.
• Process: Unexpected network traffic from the YApi Node.js process to intermediate hosts not in the expected API target list.

The primary remediation is to remove or override the rejectUnauthorized: false setting in YApi's HTTPS Axios agent configuration, restoring default TLS certificate validation. Organizations should audit all Axios or Node.js HTTPS agent configurations within the codebase for similar misconfigurations. As no official patched release has been announced by YMFE (the upstream repository has not been actively maintained since 2021), administrators should apply the fix manually or consider migrating to an actively maintained API management alternative. Network-level controls such as restricting YApi's outbound connections to known, trusted endpoints can reduce exposure in the interim (GitHub YMFE, GitHub Gist).