CVE-2021-21322
02.03.2021, 04:15
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.Enginsight
Vendor | Product | Version |
---|---|---|
fastify-http-proxy_project | fastify-http-proxy | 𝑥 < 4.3.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References