CVE-2021-21321

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

CVE-2021-21321

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

Design/Logic Flaw

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2021-21322

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

Design/Logic Flaw

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

CVE-2021-21321 Prefix escape

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

CVE-2021-21321

The CVE affects the npm package fastify-reply-from (a Fastify plugin used to forward requests to a backend). In versions prior to 4.0.2, a crafted URL could escape the proxied backend’s prefix (for example base URL /pub/), allowing access to resources that should be out of scope. Impact is data c...

CVE-2021-21321

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

@ddot/ddot-plugin-webpack (>=0.0.3, <=0.0.14), @harmonyjs/controller-auth-jwt (>=1.0.0-rc2.3, <=1.0.0) +15 more potentially affected by CVE-2021-21321 via fastify-reply-from (>=0.1.0, <=3.5.0)

fastify-reply-from NPM version =0.1.0, =0.0.3, =1.0.0-rc2.3, =1.0.0-rc2.3, =1.0.0-rc2.0, =1.0.0-beta.1, =0.0.1, =1.0.0-alpha.2, =1.0.1, =0.1.0, =0.1.0, =2.0.0, =0.2.0, =0.0.1, =0.0.6 and more Source cves: CVE-2021-21321 Source advisory: MEND:CVE-2021-21321...

CVE-2021-21322

CVE-2021-21322 affects the npm package fastify-http-proxy (a Fastify plugin for proxying HTTP requests). The vulnerability allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL, potentially exposing or tampering with data exposed by the backend (confide...

CVE-2021-21322 Prefix escape

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2021-21322

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

@ddot/ddot-plugin-webpack (>=0.0.3, <=0.0.14), @harmonyjs/controller-auth-jwt (>=1.0.0-rc2.3, <=1.0.0) +8 more potentially affected by CVE-2021-21322 via fastify-http-proxy (>=0.7.0, <=4.1.0)

fastify-http-proxy NPM version =0.7.0, =0.0.3, =1.0.0-rc2.3, =1.0.0-rc2.3, =1.0.0-rc2.0, =0.0.1, =1.0.0-alpha.2, =0.2.0, =1.1.0, =1.5.5 Source cves: CVE-2021-21322 Source advisory: MEND:CVE-2021-21322...

CVE-2021-21322: Improper Input Validation

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2021-21321: Improper Input Validation

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...

PT-2021-14419

Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...

PT-2021-14418

Name of the Vulnerable Software and Affected Versions fastify-reply-from versions prior to 4.0.2 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is "/pub/", an attacker can...

There is a vulnerability in input validation for fastify-reply-from.

Matteo Collina fastify-reply-from is Matteo Collina an open source application . It is used to forward the current http request to another server. A security vulnerability exists in fastify-reply-from before version 4.0.2, which can be exploited to escape the prefix of a proxy backend service by...

fastify-http-proxy: Input validation vulnerability

Docs fastify-http-proxy is Docs an open source application . It is used to forward all incoming requests with a given prefix or no prefix to the upstream. A security vulnerability exists in fastify-http-proxy that stems from the ability to escape the prefix of a proxy backend service by creating ...

Cross-Site Request Forgery (CSRF)

Overview Affected versions of the fastify-csrf package are vulnerable to Cross-site Request Forgery CSRF. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true . Also, the CSRF token was available in the GET query parameter...