[npm] supergateway: Unbounded HTTP Body in SSE Mode (CWE-770)

[razashariff]

Package

• Name: supergateway
• Ecosystem: npm
• Affected versions: <= 3.4.3
• Weekly downloads: ~107,000

Vulnerability

CWE-770: Allocation of Resources Without Limits or Throttling

In SSE transport mode, supergateway explicitly skips body-parser for /message endpoint (stdioToSse.ts:91-93), leaving no body size limit. Attacker sends arbitrarily large POST bodies → unbounded memory allocation → OOM → DoS.

Validated 5/5 trials, 100% reproducibility. Server accepted 50MB payloads without 413 rejection.

CVSS

7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Credit

Raza Sharif, CyberSecAI Ltd