24 matches found
Directory Traversal
Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...
@agentspec/claude-plugin (>=0.1.0, <=0.2.0), @agentspec/sidecar (0.1.0) +86 more potentially affected by CVE-2021-21322 +1 more via @fastify/http-proxy (>=9.4.0, <=11.5.0)
@fastify/http-proxy NPM version =9.4.0, =0.1.0, =1.0.19, =2.1.22, =0.1.1, =0.1.0, =0.0.4, =0.0.4, =6.0.0-canary.2685, =0.0.4, =0.0.4, =4.0.0-canary.13864, =4.0.0-canary.13864, =0.0.4, =9.0.0-canary.1784 and more Source cves: CVE-2021-21322, CVE-2026-15631 Source advisory:...
@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12281, <=9.0.0-canary.1784) +40 more potentially affected by CVE-2026-16117 via @fastify/http-proxy (>=11.1.2, <=11.5.0)
@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =1.0.0-canary.12281, =6.0.0-canary.2685, =1.0.0-canary.12281, =1.0.0-canary.12281, =4.0.0-canary.13864, =4.0.0-canary.13864, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.0.4, =0.3.0, =0.1.0, =1.0.1, =1.0.14 and more Source cves:...
EUVD-2026-45379
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...
CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...
CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...
CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...
EUVD-2026-45375
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...
PT-2026-60960
Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.4.0 through 11.5.0 Description WebSocket destination paths are not properly validated against the configured rewrite prefix. The WebSocketProxy.findUpstream function resolves destinations using the WHATWG URL...
PT-2026-60961
Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...
@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12281, <=9.0.0-canary.1784) +23 more potentially affected by CVE-2026-33805 via @fastify/http-proxy (>=11.1.2, <=11.4.3)
@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.1.0, =1.0.1, =0.0.1, =1.0.0, =1.0.1, =1.4.4, =1.0.50, =0.0.1, =0.1.65 and more Source cves: CVE-2026-33805 Source advisory:...
CVE-2026-33805
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12281, <=9.0.0-canary.1784) +23 more potentially affected by CVE-2026-33805 via @fastify/http-proxy (>=11.1.2, <=11.4.3)
@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.1.0, =1.0.1, =0.0.1, =1.0.0, =1.0.1, =1.4.4, =1.0.50, =0.0.1, =0.1.65 and more Source cves: CVE-2026-33805 Source advisory:...
CVE-2026-33805 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
CVE-2026-33805
CVE-2026-33805 affects @fastify/reply-from <= v12.6.1 and @fastify/http-proxy
EUVD-2021-0642
Malware in sbrugna...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update
Red Hat Advanced Cluster Management for Kubernetes 2.2.2 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
CVE-2021-21322
A flaw was found in fastify-http-proxy. Escaping the prefix of the proxied backend service is possible by an attacker using a specially crafted URL. The highest threat from this vulnerability is to data confidentiality and integrity...
Prefix escape
Overview In fastify-http-proxy before version 4.3.1, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...
vostok (>=1.4.0, <=1.5.5) potentially affected by CVE-2021-21322 via fastify-http-proxy (>=4.0.4, <=4.1.0)
fastify-http-proxy NPM version =4.0.4, =1.4.0, =1.5.5 Source cves: CVE-2021-21322 Source advisory: OSV:GHSA-C4QR-GMR9-V23W...