Vapor FileMiddleware Security Vulnerability

We've just released Vapor 4.60.3 which contains a fix for a security vulnerability in Vapor's FileMiddleware. An attacker could crash a Vapor application by sending invalid Range headers under certain scenarios, leading to a Denial of Service attack. This has been designated as CVE-2022-31005.

We improved the logic for checking the Range headers and added tests to ensure we catch this behavior. You can see more details on the Security Advisory on GitHub.

If you're using Vapor's FileMiddleware we recommend you upgrade to this release as soon as possible.

Thank you to Johannes Weiss for reporting!