/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::IIS6ScriptNameFix
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::IIS6ScriptNameFix - fixes wrong SCRIPT_NAME and PATH_INFO that IIS6 sets

SYNOPSIS

# in your app.psgi
use Plack::Builder;

builder {
  enable "IIS6ScriptNameFix";
  $app;
};

# Or from the command line
plackup -s FCGI -e 'enable "IIS6ScriptNameFix"' /path/to/app.psgi

DESCRIPTION

This middleware fixes wrong SCRIPT_NAME and PATH_INFO set by IIS6.

OPTIONS

force

By default, this middleware checks if SERVER_SOFTWARE PSGI environment matches what Microsoft IIS server 6-9 would set for FastCGI. By setting force to true (1), this middleware always applies the fix, regardless of the SERVER_SOFTWARE string.

Use this option if the environment is broken similar to IIS, or if the IIS is updated and the regular expression in this module doesn't match any more e.g. you're running IIS 10.

AUTHORS

Florian Ragwitz