Prefix escape

緊急 9.8CVE-2021-21322 · GHSA-c4qr-gmr9-v23w · 02/03/2021 公開 · 17/06/2026 更新

要点

CVE-2021-21322 は fastify-http-proxy (fastify-http-proxy project), fastify-http-proxy に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 76.3% より高い）。
対処：4.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
fastify-http-proxy fastify-http-proxy_project	`< 4.3.1`	`4.3.1`
fastify-http-proxy npm	`< 4.3.1`	`4.3.1`

概要

Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Patches

All releases after v4.3.1 include the fix.

Workarounds

There are no workaround available.

For more information

If you have any questions or comments about this advisory:

Open an issue in fastify-reply-from
Email us at [email protected]

NVD の説明

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.