CVE-2026-57566 · Package
NO FIX YET · SEE WHAT TO DO
Readest, an ebook reader, exposes an unauthenticated /api/opds/proxy route that fetches attacker-supplied URLs on the server without scheme or destination checks. An attacker can use it as an open proxy to read cloud metadata or internal-service responses on self-hosted deployments.
first public Oct 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Readest deployments on Node, Docker or other servers with internal-network access are the main risk, since the proxy can reach internal hosts and cloud metadata endpoints. Cloudflare Workers deployments have link-local and private destinations restricted, which reduces internal impact, but the unauthenticated public fetch-and-reflect behavior still applies. Readest versions before 0.11.10 are affected.
Not affected if managed-hosting, version-0.11.10-or-later
Who cares cloudflare-workers, docker, node, readest, self-hosted
apps/readest-app/package.json, and compare with 0.11.10./api/opds/proxy is reachable from the internet.0.11.10Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.