⬇ Download holy card: ·
Saint BadHost, Who Lied About His Own Address
Patron of ASGI frameworks, Host headers taken at face value, and middleware that protects the wrong path.
Life
On 22 May 2026 BadHost (CVE-2026-48710) went public: X41 D-Sec had found it during an OSTIF-funded audit of Starlette, the framework behind FastAPI and many AI services. Before version 1.0.1 the Host header was not validated before request.url was rebuilt: so the path seen by security middleware could differ from the one actually served, and URL-based checks were bypassed. CISA later added it to its known-exploited list.
Prayer
O Saint BadHost, who comes with an address that is not yours, let our middleware look at the true path. Amen.
How to celebrate
Celebrated by updating Starlette to 1.0.1 and basing checks on the raw path, not the rebuilt URL.
Trust the Host, and you serve the wrong door.