/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::Recursive
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::Recursive - Allows PSGI apps to include or forward requests recursively

SYNOPSIS

# with Builder
enable "Recursive";

# in apps
my $res = $env->{'plack.recursive.include'}->("/new_path");

# Or, use exceptions
my $app = sub {
    # ...
    Plack::Recursive::ForwardRequest->throw("/new_path");
};

DESCRIPTION

Plack::Middleware::Recursive allows PSGI applications to recursively include or forward requests to other paths. Applications can make use of callbacks stored in $env->{'plack.recursive.include'} to include another path to get the response (whether it's an array ref or a code ref depending on your application), or throw an exception Plack::Recursive::ForwardRequest anywhere in the code to forward the current request (i.e. abort the current and redo the request).

EXCEPTIONS

This middleware passes through unknown exceptions to the outside middleware stack, so if you use this middleware with other exception handlers such as Plack::Middleware::StackTrace or Plack::Middleware::HTTPExceptions, be sure to wrap this so Plack::Middleware::Recursive gets as inner as possible.

AUTHORS

Tatsuhiko Miyagawa

Masahiro Honma

SEE ALSO

Plack Plack::Middleware::HTTPExceptions

The idea, code and interface are stolen from Rack::Recursive and paste.recursive.