CVE-2025-70058

HIGH7.4EPSS 0.03%

yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

Published: 2/23/2026Modified: 2/25/2026
Also known as:GHSA-663h-2vr3-ghrj

Description

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References (5)