Homepage

@fastify/http-proxy@11.6.1

proxy http requests, for Fastify

  • latest version

    11.6.2

  • latest non vulnerable version

    11.6.2

  • first published

    4 years ago

  • latest version published

    7 days ago

  • licenses detected

  • View http-proxy package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @fastify/http-proxy package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Directory Traversal

    @fastify/http-proxy is a proxy http requests, for Fastify

    Affected versions of this package are vulnerable to Directory Traversal through the HTTP request path handling in index.js, including fastifyHttpProxy and reply.fromParameters. An attacker can bypass rewritePrefix path restrictions and reach upstream paths outside the intended prefix by sending a proxied request such as /pub/dir\..\..\secret. Applications that use prefix and rewritePrefix to hide part of an upstream URL space behind the proxy are exposed to path-restriction bypass; depending on the upstream service, this can expose protected resources or trigger authorization bypass in the proxied backend.

    How to fix Directory Traversal?

    Upgrade @fastify/http-proxy to version 11.6.2 or higher.

    <11.6.2
    Go back to all versions of this package