CVE-2026-27818 TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
An attacker can bypass proxy allowlist restrictions to access unauthorized domains, potentially reading internal data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27818?
CVE-2026-27818 is a high-severity server-side request forgery vulnerability in terriajs-server, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.
Which versions are affected by CVE-2026-27818?
2 open source packages ship an affected version, including terriajs-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
terriajs-server npm | All versions | 4.0.3 |
terriajs-server npm | All versions | 4.0.3 |
Products include Terria Terriajs-Server.
How do I fix CVE-2026-27818?
Upgrade terriajs-server to 4.0.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-27818 being exploited?
There is no known exploitation of CVE-2026-27818 in the wild and no public exploit code.
Sources
Also known as GHSA-w789-49fc-v8hr.