Resource exhaustion in Oakserver Oak
CVE-2025-55152
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it's possible to significantly slow down an oak server with specially crafted values of the x-forwarded-proto or x-forwarded-for headers.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.004 (31.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Oakserver Oak — versions < 17.1.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-55152?
- CVE-2025-55152 is a medium-severity vulnerability in Oakserver Oak, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2025-08-09.
- How severe is CVE-2025-55152?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-55152 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.