Common Weakness Enumeration

CWE-180 Incorrect Behavior Order: Validate Before Canonicalize

Description

The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-180 ordered by modification date.

17 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-2vc4-c4r6-p6v6	CVE-2026-100409	HIGH	npm/@opennextjs/cloudflare	OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths	2026-10-15
GHSA-hxm8-2xgr-2p9m	CVE-2026-102269	MODERATE	pypi/PyJWT	PyJWT: Non-canonical signature segments enable raw-token revocation bypass	2026-09-29
GHSA-7rqj-j65f-68wh	CVE-2026-73420	CRITICAL	npm/@auth/core npm/next-auth	Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass	2026-08-12
GHSA-89vp-jrxv-24w8	CVE-2026-73416	MODERATE	pypi/jupyterlab	JupyterLab: PyPI extension blocklist package-name canonicalization bypass	2026-08-12
GHSA-v5mv-p594-2x33	CVE-2026-69246	HIGH	-	Guzzle: Noncanonical host can bypass host-based checks	2026-08-03
GHSA-f7vp-7xgx-4w4r	CVE-2026-69245	MODERATE	-	Guzzle: Noncanonical cookie domain keeps subdomain scope	2026-08-03
GHSA-8pvw-jcv7-9cmj	CVE-2026-7120	MODERATE	npm/@fastify/static	@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths	2026-07-24
GHSA-9rfg-v8g9-9367	CVE-2026-42462	HIGH	npm/@fedify/fedify	Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring	2026-06-11
GHSA-389r-gv7p-r3rp	CVE-2026-45022	HIGH	golang/github.com/go-git/go-git/v5 golang/github.com/go-git/go-git/v6	go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git	2026-06-08
GHSA-chq7-94j8-cj28	CVE-2026-44180	CRITICAL	pypi/jupyter_enterprise_gateway	Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass	2026-06-03
GHSA-q4qf-9j86-f5mh	CVE-2026-34786	MODERATE	gem/rack	Rack:: Static header_rules bypass via URL-encoded paths	2026-05-13
GHSA-xpcf-pg52-r92g	CVE-2026-39409	MODERATE	npm/hono	Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses	2026-04-24
GHSA-v2wj-q39q-566r	CVE-2026-39364	HIGH	npm/vite	Vite: `server.fs.deny` bypassed with queries	2026-04-07
GHSA-27cr-4p5m-74rj	CVE-2026-32033	MODERATE	npm/openclaw	OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths	2026-03-25
GHSA-g966-83w7-6w38	CVE-2026-24895	HIGH	golang/github.com/dunglas/frankenphp	FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP	2026-02-12
GHSA-94vh-gphv-8pm8	CVE-2025-29787	HIGH	-	zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write	2025-03-19
GHSA-7jmw-8259-q9jx	-	MODERATE	golang/github.com/traefik/traefik golang/github.com/traefik/traefik/v2 golang/github.com/traefik/traefik/v3	Traefik has unexpected behavior with IPv4-mapped IPv6 addresses	2024-06-17