Go/github.com/SpectoLabs/hoverfly CVE-2025-54123: critical 9.8, EPSS 10.54%
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.11.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-r4h8-hfp2-ggmf
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf
- https://nvd.nist.gov/vuln/detail/CVE-2025-54123
- https://github.com/SpectoLabs/hoverfly/pull/1203
- https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40
- https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e
- https://github.com/SpectoLabs/hoverfly
- https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173
- https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13
- https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93
CVE-2025-54123 · published · modified · JSON