Web Fetch SSRF Hardening Fix in Kiro API-Proxy

Vulnerability Overview The webpage screenshot displays the changelog for an update titled “feat: Combo Fusion + Capacity auto-switch, Kiro API-key, Claude auto-ping & 429 throttle version 0.5.2.” It mentions several security-related fixes and improvements but does not explicitly reference specific vulnerabilities. Impact Scope Claude 429: throttle OAuth usage polling: This fix involves rate-limiting OAuth usage polling, which may affect services relying on OAuth authentication. Usage logs always empty: missing await on getAdapter() in getRecentLogs: This fix resolves the issue where usage logs were always empty, potentially impacting logging functionality. Executors: strip params unsupported by provider/model (claude-opus-4 temperature 400): This fix removes unsupported parameters, which may impact model execution. Translator: deterministic tool_call ids for gemini/antigravity -> OpenAI (tool-pairing 400s): This fix ensures deterministic tool call IDs, which may impact tool calling functionality. Antigravity: strip optional from tool schemas before Gemini: This fix removes optional fields from tool schemas, which may impact tool schema parsing. Claude-to-OpenAI: handle OpenAI-format responses in streaming path: This fix handles OpenAI-format responses within the streaming path, which may impact streaming response functionality. Usage views: consistent edited connection names across Providers & Quota Tracker: This fix ensures consistency in connection names, which may impact connection management. Security: hardened reverse-proxy local-access trust + SSRF hardening on web fetch: This fix strengthens trust in reverse-proxy local access and hardens against SSRF (Server-Side Request Forgery) during web fetches, potentially impacting network request security. Remediation Claude 429: throttle OAuth usage polling: Prevents excessive requests by rate-limiting OAuth usage polling. Usage logs always empty: missing await on getAdapter() in getRecentLogs: Adds in the function to ensure logs are recorded correctly. Executors: strip params unsupported by provider/model (claude-opus-4 temperature 400): Removes unsupported parameters to ensure correct model execution. Translator: deterministic tool_call ids for gemini/antigravity -> OpenAI (tool-pairing 400s): Ensures deterministic tool call IDs to avoid duplicates or conflicts. Antigravity: strip optional from tool schemas before Gemini: Removes optional fields from tool schemas to ensure accurate schema parsing. Claude-to-OpenAI: handle OpenAI-format responses in streaming path: Handles OpenAI-format responses in the streaming path to ensure correct data transmission. Usage views: consistent edited connection names across Providers & Quota Tracker: Ensures consistency in connection names to avoid confusion. Security: hardened reverse-proxy local-access trust + SSRF hardening on web fetch: Strengthens reverse-proxy local access trust and SSRF protection to enhance the security of network requests. POC Code or Exploit Code No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Web Fetch SSRF Hardening Fix in Kiro API-Proxy

More from this source