forwarded

Regular Expression Denial of Service in forwarded

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Astro's `X-Forwarded-Host` is reflected without validation

Angular SSR has an Open Redirect via X-Forwarded-Prefix