/ 
Plack-Middleware-Security-Simple-v0.13.0
⭐ Starred 2
Security Advisories (1)
CVE-2026-9658 (2026-05-28)

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Changes for version v0.13.0 - 2025-05-09

  • Enhancements
    • The misc_extensions rule now blocks .dist, .env, .lck, .lock, .sav, .save, .swp, .swap, .tmp, .temp, and .yaml files.
    • Added Swagger files to the cms_prefixes rule.
    • Added the config_scripts rule.
  • Documentation
    • Added a How to Contribute document.
    • Updated the security policy.
    • Fixed minor typos.
  • Tests
    • Added more author tests.

Documentation

CONTRIBUTING.md
README.md
SECURITY.md

Modules

Plack::Middleware::Security::Common
A simple security filter for Plack with common rules.
Plack::Middleware::Security::Simple
A simple security filter for Plack

Other files