CVE-2026-27818: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27818 is a domain validation bypass vulnerability in TerriaJS-Server, a NodeJS Express server used to build web-based geospatial data explorers. A flaw in the proxy allowlist validation logic allows unauthenticated attackers to proxy requests to domains not explicitly permitted in the proxyableDomains configuration. All versions prior to 4.0.3 are affected; version 4.0.3 resolves the issue. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, GHSA Advisory). The vulnerability was published by the GitHub Advisory Database on February 24, 2026, and by NVD on February 26, 2026.

The root cause is improper input validation (CWE-20) in the proxy controller (lib/controllers/proxy.js), which also enables Server-Side Request Forgery (CWE-918). The vulnerable code used host.indexOf(allowedDomain, host.length - allowedDomain.length) !== -1 to check if a hostname ended with an allowed domain string — a suffix check that does not enforce a dot boundary. This means if example.com is in proxyableDomains, a hostname like maliciousexample.com would also pass validation, allowing an attacker to register such a domain and route proxy traffic through the server. The fix in commit 3aaa5d9 replaces the suffix check with a strict equality or subdomain check: host === domainLower || host.endsWith("." + domainLower) (Patch Commit, GitHub Advisory).

Successful exploitation allows an attacker to abuse the TerriaJS-Server proxy to forward requests to unauthorized external domains, effectively bypassing the proxyableDomains security control. This can enable unauthorized access to internal systems, backend services, or restricted network resources reachable from the server, and may facilitate data exfiltration or lateral movement within the network. No authentication or user interaction is required, making the attack surface broad for any internet-exposed TerriaJS-Server instance. Confidentiality and availability of the vulnerable system itself are not directly impacted, but integrity is rated High due to the ability to subvert proxy security controls (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker against unpatched instances. The EPSS score is approximately 0.082–0.089%, indicating a low but non-negligible probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing TerriaJS-Server instances (versions < 4.0.3) using tools like Shodan or Censys, searching for the TerriaJS-Server banner or known API endpoints.
2. Identify allowed domains: Review publicly accessible TerriaJS configuration files or observe proxy behavior to infer which domains are listed in proxyableDomains (e.g., example.com).
3. Register a bypass domain: Register a domain that shares a suffix with an allowed domain but lacks a dot boundary separator (e.g., maliciousexample.com to bypass example.com).
4. Craft a proxy request: Send an HTTP request to the TerriaJS-Server proxy endpoint targeting the attacker-controlled domain, e.g., GET /proxy/https://maliciousexample.com/path.
5. Achieve SSRF/proxy abuse: The server's flawed suffix validation passes the hostname check, and the server proxies the request to the attacker's domain — or to internal resources if the bypass domain resolves to an internal IP — enabling data exfiltration, SSRF, or content injection (GHSA Advisory, Patch Commit).

• Network: Outbound proxy requests from the TerriaJS-Server to unexpected or attacker-controlled domains that share a suffix with (but are not subdomains of) configured proxyableDomains entries; unusual outbound connections to external IPs not matching the intended allowlist.
• Logs: HTTP access logs showing proxy endpoint requests (e.g., GET /proxy/https://maliciousexample.com/...) where the target hostname is not a legitimate subdomain of any configured allowed domain; repeated proxy requests to novel or recently registered domains.
• Configuration: Review proxyableDomains configuration and cross-reference all proxied hostnames in logs — any hostname that ends with but is not equal to or a dot-prefixed subdomain of an allowed entry is suspicious.

Upgrade TerriaJS-Server to version 4.0.3 or later, which fixes the domain validation logic to require exact domain matches or proper subdomain relationships (dot-separated prefix) (GitHub Advisory, Patch Commit). As interim mitigations, implement network-level egress filtering to restrict outbound connections from the TerriaJS-Server to only known-good IP ranges, and monitor proxy request logs for anomalous domain access patterns. Review and tighten the proxyableDomains configuration to include only the minimum necessary domains.

The vulnerability was disclosed by peterhassall via the GitHub Security Advisory program on February 24, 2026, and the fix was committed by zoran995. Coverage has been limited to automated vulnerability tracking platforms (VulnDB, CVEFeed, CIRCL, ENISA EUVD) with no notable independent researcher commentary or significant social media discussion identified at this time (GHSA Advisory).