From c592f0aa694dbd647bc56dea8094eff30ab4e5dd Mon Sep 17 00:00:00 2001 From: Alex Newman Date: Wed, 17 Dec 2025 19:26:07 -0500 Subject: [PATCH] chore: update CHANGELOG.md --- CHANGELOG.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b7e842f..a7687c4f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). +## [7.3.8] - 2025-12-18 + +## Security Fix + +Added localhost-only protection for admin endpoints to prevent DoS attacks when worker service is bound to 0.0.0.0 for remote UI access. + +### Changes +- Created `requireLocalhost` middleware to restrict admin endpoints +- Applied to `/api/admin/restart` and `/api/admin/shutdown` +- Returns 403 Forbidden for non-localhost requests + +### Security Impact +Prevents unauthorized shutdown/restart of worker service when exposed on network. + +Fixes security concern raised in #368. + ## [7.3.7] - 2025-12-17 ## Windows Platform Stabilization