@ai-sdk/topaz 3.0.20 Improves Security for Video Uploads
The latest patch for @ai-sdk/topaz introduces stricter handling of video upload URLs by rejecting redirects and leveraging DNS-pinned fetch to mitigate security risks like DNS rebinding.
What changed?
@ai-sdk/topaz version 3.0.20 now rejects HTTP redirects when uploading input videos. The update also enforces the use of DNS-pinned fetch for untrusted upload URLs. This change prevents both HTTP redirects and DNS rebinding attacks from bypassing URL validation.
Why does it matter to an everyday developer?
Video upload endpoints can be exploited using redirects or DNS rebinding to subvert security controls, potentially exposing sensitive infrastructure or enabling data exfiltration. By rejecting redirects and pinning DNS for untrusted upload URLs, this release significantly reduces attack surface, protecting applications that handle external or user-submitted video content.
What can the developer do now?
No code changes are required for existing users, as this patch is not breaking. Developers should update to @ai-sdk/topaz 3.0.20 to benefit from improved security. Validate in your development and staging environments to ensure uploads behave as expected, especially if your workflows rely on URL redirects for video files.