Serguey Asael Shinder: Vaadin Flow 25.2.13 stops echoing any Origin on push; 24.x gets the CVE-2026-2742 fix
Vaadin published three Flow patch releases on 12 October: 25.2.13, 24.7.15 and 24.4.18. Each is short, and each has one change worth reading before upgrading.
25.2.13: push no longer allows any origin with credentials. The fix comes from PR 26215, labelled security, which affects every application using @Push. Atmosphere, the library behind Flow's push, installs a CorsInterceptor by default. For non-WebSocket requests it copied the request's Origin into Access-Control-Allow-Origin, set Access-Control-Allow-Credentials: true and answered OPTIONS preflights itself — so, in the PR's words, "any origin was echoed back with credentials allowed". A 2015 change had meant to turn this off but set the parameter to false, which is Atmosphere's default, so the interceptor stayed on. Flow now sets DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER to true.
The behaviour change is narrow: WebSocket push is not affected. Applications embedded cross-origin that use push over the long-polling fallback now have to answer push OPTIONS preflights in their own CORS filter, or opt back in with the servlet init parameter org.atmosphere.cpr.dropAccessControlAllowOriginHeader=false.
The same release handles push requests that find no session (PR 26169): they used to fail with a NullPointerException, and are now treated like an expired session. It also keeps forwarded query parameters when navigation adds a trailing slash.
24.7.15 and 24.4.18: CVE-2026-2742 reaches the older lines. PR 26108 backports the fix for CVE-2026-2742 (GHSA-rjgh-wgc7-m37j): requests to Vaadin's reserved folders, such as /VAADIN without a trailing slash, /themes and /assets, are no longer handled by IndexHtmlRequestHandler. According to the PR, with Spring Security those requests could get past the security filters. Both releases also update glob in the theme plugins to 10.5.0 for CVE-2025-64756.
24.4.18 also raises the Node minimum. PR 26194 moves the supported Node.js minimum from 18.12 to 20.0 and npm from 8.6 to 9.6, to match 24.7. The PR explains why: a transitive dependency of the frontend build now needs Node 20, so a global Node 18 install made the build fail. A global Node older than 20 is no longer used; Flow logs a message and installs its own default Node into ~/.vaadin.
What to do. Teams on 25.2 using push across origins should test the long-polling path before rolling out. Teams on 24.7 or 24.4 with Spring Security get a security fix in a patch release, and 24.4 builds on machines with Node 18 will switch to Flow's own Node.