Headroom patches a security hole in its agent proxy

Headroom shipped version 0.36.4 on August 22, closing a validation gap in its agent proxy, per the release notes. Route agent traffic through Headroom and an unvalidated upstream becomes a redirect primitive. A request meant for one destination can get sent somewhere else instead.

The project is a context-compression proxy and MCP server with 67,241 stars on GitHub. As an MCP server, it sits in the same path agents use to reach tools and models. Some resolution paths were checking caller-supplied upstreams and some weren't. PR #3195 closes that gap, validating every path, according to the pull request.

The same day, Headroom shipped 0.36.5, fixing Codex ChatGPT auth detection, the notes say. Two releases in one day on a proxy this widely deployed reads as the maintainers moving fast once they'd found the gap.

The release notes don't say whether the gap was exploited before the patch landed. Anyone running Headroom in front of agent traffic should be on 0.36.5, not 0.36.4 alone.