| Package | Affected versions | Patched versions |
|---|---|---|
| reply-from | ≤ 12.4.0 | |
| @fastify/reply-from | < 12.5.0 | 12.5.0 |
By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.
An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl version 8.7.1, is %2e%2e.
Everyone is using this package with the routes option to protect a 3rd-party resource.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free