{"action":"Upgrade @portkey-ai/gateway to 1.14.0 or later.","affected":[{"fixed":"1.14.0","introduced":"0"}],"component":"@portkey-ai/gateway","cve_ids":["CVE-2025-66405"],"ecosystem":"npm","epss":0.00397,"exploited":false,"fixed_versions":["1.14.0"],"ghsa_id":"GHSA-hhh5-2cvx-vmfp","id":"tcs_01M5KFV7KV0RBJ8MG3E2R74GR0","modified_at":"2025-12-02T01:53:14.002296Z","published_at":"2025-12-02T01:08:37Z","references":["https://osv.dev/vulnerability/GHSA-hhh5-2cvx-vmfp","https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp","https://nvd.nist.gov/vuln/detail/CVE-2025-66405","https://github.com/Portkey-AI/gateway/pull/1372","https://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885","https://github.com/Portkey-AI/gateway"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hhh5-2cvx-vmfp","url":"https://osv.dev/vulnerability/GHSA-hhh5-2cvx-vmfp"},{"source":"nvd","source_id":"CVE-2025-66405","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66405"}],"summary":"Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host"}