CVE-2025-66570 is a critical (CVSS 10.0) flaw in cpp-httplib, the single file C++ HTTP library. Clients can send headers named REMOTE_ADDR and similar, and code that reads them may get the attacker value. Upgrade to 0.27.0 and review any logic that trusts those names.
What's affected
cpp-httplib releases before 0.27.0. The GitHub advisory gives the range as 0.26.0 and earlier, with 0.27.0 as the patched version, and the NVD record says the same thing in different words. The score of 10.0 in the record matches the advisory.
Because cpp-httplib is a header only library, there is no package to upgrade in a system folder. Each project carries its own copy of httplib.h, or pulls it through a package manager, a git submodule or a vendored directory. That makes inventory the hard part of this fix.
How to check if you're exposed
Look for the library version macro in every copy of the header you ship:
grep -rn "CPPHTTPLIB_VERSION" --include=httplib.h .
Then search your own handlers for the four affected header names, since those are the places that can be fooled:
grep -rnE "REMOTE_ADDR|REMOTE_PORT|LOCAL_ADDR|LOCAL_PORT" src include
Also check vcpkg, Conan and CMake FetchContent pins, and any container image that builds a service from source.
What to do now
- List every project that includes httplib.h and read its version macro.
- Update to 0.27.0 or later and rebuild every binary that embeds the header.
- Audit handlers, middleware and loggers that read REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR or LOCAL_PORT from request headers.
- Make sure authorization never depends on a client address read from a header. Use the real socket peer data, or a reverse proxy you control.
- Review old access logs, because the advisory notes that spoofed values can poison log entries.
Why it matters
The advisory describes a header shadowing problem. The parser stores every client header in a multimap. Later, the server adds its own metadata under the same names without removing duplicates. The accessor returns the first match, and the client header was parsed first, so application code can read the attacker value instead of the server value.
The weaknesses are labeled CWE-290 (authentication bypass by spoofing), CWE-345 (insufficient verification of data authenticity) and CWE-807 (reliance on untrusted inputs in a security decision). The advisory says the worst case is an authorization bypass where a handler trusts a spoofed address to grant access to admin or localhost only endpoints. Whether you are exposed depends on how your code uses those names, which is why reachability matters here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I only use cpp-httplib as a client. Am I affected?
The advisory describes incoming request headers on the server side. A pure client use is not the described path, but confirm which classes you use.
Does upgrading remove the need to audit my code?
The upgrade fixes the library behavior. Code that trusts client controlled headers for access decisions is still a design risk, so audit it anyway.
Sources
- Safeguard Gold page for CVE-2025-66570
- GitHub security advisory GHSA-xm2j-vfr9-mg9m
- Fix commit (listed in the record)
Last reviewed: 18 October 2026.
