Prefix escape

Overview

In fastify-http-proxy before version 4.3.1, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.

Recommendation

Upgrade to version 4.3.1 or later.

References

• GitHub Advisory
• CVE