Prefix escape

NGHIÊM TRỌNG 9.8CVE-2021-21322 · GHSA-c4qr-gmr9-v23w · Công bố 02/03/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-21322 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng fastify-http-proxy (fastify-http-proxy project), fastify-http-proxy.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.6%, cao hơn 76.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.3.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
fastify-http-proxy fastify-http-proxy_project	`< 4.3.1`	`4.3.1`
fastify-http-proxy npm	`< 4.3.1`	`4.3.1`

Mô tả

Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Patches

All releases after v4.3.1 include the fix.

Workarounds

There are no workaround available.

For more information

If you have any questions or comments about this advisory:

Open an issue in fastify-reply-from
Email us at [email protected]

Mô tả của NVD

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.