The vulnerability in openstatusHQ openstatus involves server-side request forgery due to manipulation in the resolve-custom-domain-rewrite.ts file. This allows remote attackers to induce the server to send crafted requests to unintended destinations. Because the product uses a rolling release model, exact affected versions are not specified. The issue has been addressed by a silent patch identified by commit 86f370c9c20074c3c3fdec53a359874b8e670fd4. No known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated remote attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. The impact is rated medium based on the CVSS 4.0 score of 5.3. There is no indication of privilege escalation or data disclosure beyond the SSRF capability.

A patch addressing this vulnerability has been silently applied in the rolling release model of openstatusHQ openstatus. Users should ensure their installations are updated to the latest version containing commit 86f370c9c20074c3c3fdec53a359874b8e670fd4. Since the product updates continuously, no specific version upgrade is required beyond applying the latest updates.