The archive/CVE-2022-33987
sindresorhus/gotDisclosed 2022

CVE-2022-33987:got: SSRF via redirect to a UNIX-domain socket

A reconstruction of the flaw, and the evidence path Lachesis follows to make it visible.

Historical recordv11.8.3 (affected: <11.8.5 & 12.0.0-12.1.0)
WeaknessCWE-918 → CWE-601 · SSRF via redirect to a UNIX-domain socket
ImpactA ssrf via redirect to a unix-domain socket in got, reachable from attacker-controlled input.
Read the reconstruction ↓
01What happened

A 3xx redirect to a `unix:` URL that got follows without re-validating the scheme, connecting to a local socket.

That is the shape of the failure. The rest of this case file follows the evidence behind it.

Separate the record from the run

What was known.
What Lachesis established.

01Historical record

Known before Lachesis ran

The CVE and vulnerable release were selected from public history. We are not claiming novel discovery.

CVE
CVE-2022-33987
Vulnerable target
v11.8.3 (affected: <11.8.5 & 12.0.0-12.1.0) · vulnerable
Prior knowledge
CVE-2022-33987 · v11.8.3 (affected: <11.8.5 & 12.0.0-12.1.0) is vulnerable
then→
02Lachesis run
Verified captured run

Independent re-detection

The experiment graph was built around the vulnerable release, enriched (pass2 dataflow + atropos bind + pass3 semantic), then enumerated BLIND over the whole constructor registry (no family hard-coded, no target line seeded). The lead below is the class-matched candidate the enumerator surfaced on its own; the provenance and body reads are the tool's own follow-up operations. Prose in `adjudication`/`trace` is MY reading of the verbatim source + official fix, clearly separated from tool output.

Seeded inputs
None
Run timestamp
2026-08-29T00:00:00Z
Evidence artifact
cve-2022-33987.kuzu (built from the vulnerable release, enriched pass2+pass3; graph + sidecars deleted after capture)

The commands and outputs below come from this recorded Lachesis run.

The reconstruction, in one frame

What Lachesis reconstructed.

One historical repository. Four captured queries. A complete source-to-sink argument.

Lachesis Casefiles · Unbound ComputeVerified runCVE-2022-33987
A 3xx redirect to a `unix:` URL that got follows without re-validating the scheme, connecting to a local socket.
01Sourceconst redirectBuffer = Buffer.from(response.headers.location, 'binary').toString();
→
02SinkObject.assign(options, {socketPath, path, host: ''})
→
03Missing guardoptions.url = redirectUrl
$ lachesis sources_of → reaches → guard_dominance
sindresorhus/got · v11.8.3 (affected: <11.8.5 & 12.0.0-12.1.0) · vulnerableunboundcompute.com
↳
This was known history. Your code is not.

Lachesis follows the same evidence path through unfamiliar repositories.

Run Lachesis on your repository ↗
The Lachesis reconstruction

Here is how the path becomes visible.

These are the recorded questions Lachesis asked of the historical vulnerable code, followed by the raw result and source location each query returned.

Repositorysindresorhus/got
Revisionv11.8.3 (affected: <11.8.5 & 12.0.0-12.1.0) · vulnerable
EngineLachesis

Captured runA real replay of Lachesis over the graph we built for this case. Every `output` below is verbatim captured tool text; the graph was built bounded (hard memory/time cap) and released immediately after capture, so nothing accumulates.

01 · load_graph01 / 05
Lachesis ran
load_graph --path cve-2022-33987.kuzu --profile all && candidate_census

Load the graph and list every bug family

Load the graph built from the vulnerable release and list every bug family the blind enumerator knows -- no family is pre-selected.

Captured resultCaptured · load_graph
raw captured outputload_graph
{"move": "load_graph", "graph": "~/.lachesis/graphs/cve-2022-33987.kuzu", "profile": "all", "nodes": 24275}
CANDIDATE_CENSUS
move: candidate_census
taxonomy (8):
    domain=lifecycle  title=Resource lifecycle  meaning=an operation that acquires, releases, uses, or transfers a tracked resource  obligation=resource operations stay within the object's lifetime  primary=True  languages=['c', 'python', 'javascript', 'typescript']  enumerable=True  families=[{'family': 'acquire', 'obligation': 'resource acquisition', 'constructor': 'lifecycle.acquire', 'enumerable': True}, {'family': 'release', 'obligation': 'resource release', 'constructor': 'lifecycle.release', 'enumerable': True}, {'family': 'use', 'obligation': 'tracked resource use', 'constructor': 'lifecycle.use', 'enumerable': True}, {'family': 'escape', 'obligation': 'resource ownership transfer', 'constructor': 'lifecycle.escape', 'enumerable': True}, {'family': 'leak', 'obligation': 'Allocated object remains live at an exit', 'constructor'
    ... [truncated]
source/core/index.jsline 0
Code location returned for this evidence step.
The repair

A small line with a large consequence.

the redirect-derived URL is assigned as the next request's URL with no re-validation that its scheme is still http/https -- the initial unix: guard at 1673-1676 does not run again on the redirect target, so a `unix:` Location flows straight to the socket-connect path

Before
options.url = redirectUrl
After the patch
// fixed in 11.8.5/12.1.0 (861ccd9): redirects whose resolved target is a UNIX-socket URL are rejected
Sources & further reading

The original record.

Read the historical advisory and vulnerability record behind this reconstruction.

NVD record ↗Repository ↗Unbound security blog ↗Lachesis at Unbound Compute ↗
Open the Lachesis quickstart ↗