CVE-2026-50288
Received Received - Intake

SpecifyJS URL Parsing Flaw Allows Unsafe Requests

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-50288
EUVD
EUVD-2026-64065

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
asymmetric_effort specifyjs to 0.2.136 (exc)
specifyjs specifyjs to 0.2.136 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50288 is a vulnerability in SpecifyJS, a TypeScript UI framework. The issue occurs in the `assertSecureUrl` function where a failed URL parse by `new URL()` caused the function to return silently without throwing an error. This allowed requests to proceed without HTTPS validation, potentially enabling Server-Side Request Forgery (SSRF). The flaw was fixed in version 0.2.136 by modifying the catch block to throw an error instead of returning silently.

The vulnerability is labeled PT-001 and affects versions prior to 0.2.136 of the @asymmetric-effort/specifyjs npm package.

Detection Guidance

To detect this vulnerability, check if your system uses SpecifyJS versions prior to 0.2.136. Inspect the package.json file for the dependency version. If using npm, run: npm list @asymmetric-effort/specifyjs. If the version is below 0.2.136, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to bypass HTTPS validation and make unauthorized requests from your server, potentially leading to Server-Side Request Forgery (SSRF). This might enable access to internal systems, sensitive data, or other network resources that should be restricted.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling Server-Side Request Forgery (SSRF), which may allow unauthorized access to internal systems or data. SSRF risks exposure of sensitive data or systems, violating confidentiality requirements under both regulations.

Mitigation Strategies

Immediately update SpecifyJS to version 0.2.136 or later. Use the command: npm update @asymmetric-effort/specifyjs. If direct update is not possible, review and modify the secure-fetch.ts file to ensure the catch block throws errors for URL parse failures instead of silently returning.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart