Whistle CVE-2026-55629

Whistle is a Node.js-based cross-protocol (HTTP/HTTP2/HTTPS/WebSocket) debugging proxy commonly run by developers to capture and rewrite traffic. The vulnerable logic lives in lib/service/service.js, which implements the /cgi-bin/temp/get handler for downloading Whistle's own temporary capture files stored under config.TEMP_FILES_PATH. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the handler applies a path-safe join to TEMP_FILES_PATH only when the supplied filename matches the expected temp-file naming pattern, but falls through to passing the attacker-controlled filename directly into getFile for any non-matching value. With no canonicalization or traversal-sequence filtering on that fallback path, ../ sequences resolve outside the intended temp directory to any file the Whistle process user can read. The fixing commit (777bcf6) is a broad release change touching config.js, HTTPS/CA and WebSocket handling; the security-relevant hardening is bundled into the 2.10.3 release rather than isolated in the visible diff hunks.