Changes for version 0.17 - 2026-10-13

  • SECURITY: Ignore non-numeric X-Forwarded-Port instead of copying it verbatim into SERVER_PORT and HTTP_HOST (related to CVE-2026-110335)
  • Only accept ASCII digits as port numbers in Host, X-Forwarded-Host and X-Forwarded-Server

Modules

Supports app to run as a reverse proxy backend