Changes for version 0.17 - 2026-10-13
- SECURITY: Ignore non-numeric X-Forwarded-Port instead of copying it verbatim into SERVER_PORT and HTTP_HOST (related to CVE-2026-110335)
- Only accept ASCII digits as port numbers in Host, X-Forwarded-Host and X-Forwarded-Server
Modules
Supports app to run as a reverse proxy backend