{"repo":"NousResearch/hermes-agent","public_id":"126118","display_label":"Proxy Host and Origin header validation hardening","summary":"These items address a DNS rebinding vulnerability in the Hermes proxy where Host and Origin headers were not validated. The work involves restricting accepted Host values to local names and rejecting foreign browser Origins.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":130513,"merged_at":"2026-10-03T10:59:18+00:00"},"resolution":{"state":"resolved","by":"pr-130513"},"freshness":{"state":"verified","last_verified_at":"2026-10-03T10:59:18+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":126118,"pr_number":130513,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-03T10:59:18+00:00"}],"members":[{"kind":"issue","number":126118,"title":"[Bug]: hermes proxy accepts any Host header and any browser Origin","url":null,"state":"closed"},{"kind":"pr","number":126121,"title":"fix(proxy): accept only local Host names and no foreign browser Origin","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"ee5f49b943f8a92165c598d23f52ab9b39c41ce7","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":126202,"title":"fix(proxy): harden Host and Origin boundary against DNS rebinding","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#126121","number":126121},{"kind":"pr","value":"#126118","number":126118}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":130513,"title":"fix(proxy): web pages in your browser can no longer spend the subscription proxy's credential (#126118, salvage #126121)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/proxy/server.py","tests/hermes_cli/test_proxy.py","website/docs/user-guide/features/subscription-proxy.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/subscription-proxy.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}