---
id: "CVE-2026-57566"
kind: "vulnerability"
aliases: ["CVE-2026-57566"]
title: "Readest: unauthenticated OPDS proxy lets anyone fetch internal URLs"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudflare-workers", "docker", "node", "package", "readest", "self-hosted"]
not_affected_if: ["managed-hosting", "version-0.11.10-or-later"]
published_at: "2026-11-04T22:18:06+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:09:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57566", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# Readest: unauthenticated OPDS proxy lets anyone fetch internal URLs

Readest, an ebook reader, exposes an unauthenticated /api/opds/proxy route that fetches attacker-supplied URLs on the server without scheme or destination checks. An attacker can use it as an open proxy to read cloud metadata or internal-service responses on self-hosted deployments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Readest version in the deployed app's package.json or release tag, e.g. `apps/readest-app/package.json`, and compare with `0.11.10`.
- Confirm whether the deployment is self-hosted on Node or Docker rather than Cloudflare Workers, since the description says Workers restrict link-local and private destinations.
- Check whether the route `/api/opds/proxy` is reachable from the internet.

## Fix

- Readest: upgrade to `0.11.10`

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57566

## Documents

- [advisory] Vendor advisory: github.com https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx
- [fix] Patch: github.com https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de
- [fix] Release notes: github.com https://github.com/readest/readest/releases/tag/v0.11.10

## From the sources

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_