GHSA-9ghw-48h5-v2w5: Input Validation

Q: Who can exploit this issue?

An attacker must be authenticated to Backstage by default. The issue is limited to servers that are already configured as proxy endpoints in the Backstage proxy backend.

Q: What can an attacker do through a vulnerable proxy endpoint?

An authenticated user can craft a request URL that makes the proxy backend forward a request to a path outside the configured base path on the target server. The impact is constrained to the configured target server rather than arbitrary new proxy destinations.

Q: Which version contains the fix?

The issue is patched in @backstage/plugin-proxy-backend version 0.6.17.

Q: What mitigation is available if the package cannot be patched immediately?

Place a reverse proxy or web application firewall in front of Backstage and configure it to normalize request paths before they reach the backend.

Published Oct 7, 2026

Updated

Impact

An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default.

Patches

Patched in @backstage/plugin-proxy-backend version 0.6.17

Workarounds

- Deploy a reverse proxy or WAF in front of Backstage that normalizes request paths before they reach the backend.

Affected Software

1 affected componentFixes available

npm/@backstage/plugin-proxy-backend<0.6.17

0.6.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@backstage/plugin-proxy-backend to a version that resolves this vulnerability.
Fixed in 0.6.17
Upgrade
Upgrade @backstage/plugin-proxy-backend to a version that resolves this vulnerability.
Fixed in 0.6.17
Compensating control
Deploy a reverse proxy or WAF in front of Backstage that normalizes request paths before they reach the backend.

Event History

Oct 7, 2026

Advisory Published

via GitHub·05:59 PM

Data Sourced

via GitHub·05:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Backstage by default. The issue is limited to servers that are already configured as proxy endpoints in the Backstage proxy backend.

What can an attacker do through a vulnerable proxy endpoint?

An authenticated user can craft a request URL that makes the proxy backend forward a request to a path outside the configured base path on the target server. The impact is constrained to the configured target server rather than arbitrary new proxy destinations.

Which version contains the fix?

The issue is patched in @backstage/plugin-proxy-backend version 0.6.17.

What mitigation is available if the package cannot be patched immediately?

Place a reverse proxy or web application firewall in front of Backstage and configure it to normalize request paths before they reach the backend.

GHSA-9ghw-48h5-v2w5: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through a vulnerable proxy endpoint?

Which version contains the fix?

What mitigation is available if the package cannot be patched immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through a vulnerable proxy endpoint?

Which version contains the fix?

What mitigation is available if the package cannot be patched immediately?