fumadocs-openapi: createProxy() open proxy and SSRF by default

1. Upgrade fumadocs-openapi to 11.2.2 or later.
2. Pass an explicit allowedOrigins list (only the API origins your playground needs) or a filterRequest function to createProxy().
3. If you cannot upgrade yet, remove the proxy route or put it behind authentication.

The createProxy() helper in fumadocs-openapi builds the route handler that the API playground uses to send requests. Before 11.2.2, its allowedOrigins and filterRequest options were optional and the origin check was skipped when neither was set, so a docs site that mounted the proxy route with the defaults became an unauthenticated open forward proxy. Anyone could make the server fetch internal addresses, such as cloud metadata endpoints or localhost admin ports. Even with an allowlist, redirects were followed without re-checking the destination.

fumadocs-openapi before 11.2.2, on any deployed site that mounts a createProxy() route without allowedOrigins or filterRequest. Reviewed on 11.1.1.

• Default configuration. The route proxies any ?url= target. On a cloud host this can expose instance metadata credentials, and any internal service, localhost port or private-range host the server can reach is in scope. Inbound headers are forwarded and a ?cookie= parameter sets the outgoing Cookie header, so the route also works as an anonymizing proxy.
• With an allowlist. Only the first URL was checked. fetch() followed redirects by default, so an allowed upstream that redirects to an internal host bypassed the allowlist.

• packages/openapi/src/server/proxy.ts: the origin check ran only if (allowedOrigins && ...), and fetch() was called with the default redirect: 'follow'

• Fumadocs 11.2.2 (6c949cb) makes allowedOrigins default to the proxy route's own origin, logs a warning when no allowlist is configured, and enforces the allowlist on each redirect hop.

Review access logs for the proxy route (often /api/proxy) with url= values pointing at private, loopback or link-local addresses, cloud metadata hosts, or origins your playground never uses.

1. 2026-07-16Reported to the maintainer by email.
2. 2026-07-16Maintainer ships the fix in fumadocs-openapi 11.2.2 (6c949cb).
3. 2026-07-20Formal report via GitHub PVR (GHSA-7r23-3v7p-56ff) once it was enabled; the maintainer accepts and closes it the same day without publishing.
4. 2026-09-23CVE IDs requested from MITRE.
5. 2026-10-09Public write-up.

Finder: Aaron Elijah Mars of Aeon. Tool: Aeon.

• Fix commit: fuma-nama/fumadocs@6c949cb
• Fixed release: fumadocs-openapi 11.2.2
• GitHub advisory: GHSA-7r23-3v7p-56ff (private; accepted and closed, not published)
• CVE: pending (requested from MITRE)
• Affected repository: fuma-nama/fumadocs