/ 
Plack-1.0023
⭐ Starred 488 / Plack::Middleware::StackTrace
Security Advisories (3)
CVE-2026-7381 (2026-04-29)

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.

CPANSA-Plack-2015-0202 (2015-02-02)

Fixed a possible directory traversal with Plack::App::File on Win32.

CPANSA-Plack-2014-0801 (2014-08-01)

Plack::App::File would previously strip trailing slashes off provided paths. This in combination with the common pattern of serving files with Plack::Middleware::Static could allow an attacker to bypass a whitelist of generated files

NAME

Plack::Middleware::StackTrace - Displays stack trace when your app dies

SYNOPSIS

enable "StackTrace";

DESCRIPTION

This middleware catches exceptions (run-time errors) happening in your application and displays nice stack trace screen. The stack trace is also stored in the environment as a plaintext and HTML under the key plack.stacktrace.text and plack.stacktrace.html respectively, so that middleware futher up the stack can reference it.

This middleware is enabled by default when you run plackup in the default development mode.

You're recommended to use this middleware during the development and use Plack::Middleware::HTTPExceptions in the deployment mode as a replacement, so that all the exceptions thrown from your application still get caught and rendered as a 500 error response, rather than crashing the web server.

Catching errors in streaming response is not supported.

CONFIGURATION

force
enable "StackTrace", force => 1;

Force display the stack trace when an error occurs within your application and the response code from your application is 500. Defaults to off.

The use case of this option is that when your framework catches all the exceptions in the main handler and returns all failures in your code as a normal 500 PSGI error response. In such cases, this middleware would never have a chance to display errors because it can't tell if it's an application error or just random eval in your code. This option enforces the middleware to display stack trace even if it's not the direct error thrown by the application.

no_print_errors
enable "StackTrace", no_print_errors => 1;

Skips printing the text stacktrace to console (psgi.errors). Defaults to 0, which means the text version of the stack trace error is printed to the errors handle, which usually is a standard error.

AUTHOR

Tokuhiro Matsuno

Tatsuhiko Miyagawa

SEE ALSO

Devel::StackTrace::AsHTML Plack::Middleware Plack::Middleware::HTTPExceptions