HTTP Request Smuggling Affecting @fastify/reply-from package, versions <9.6.0
Threat Intelligence
EPSS
0.05% (18th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-FASTIFYREPLYFROM-6146944
- published 9 Jan 2024
- disclosed 8 Jan 2024
- credit qwerty472123
Introduced: 8 Jan 2024
CVE-2023-51701 Open this link in a new tabHow to fix?
Upgrade @fastify/reply-from to version 9.6.0 or higher.
Overview
@fastify/reply-from is a forward your HTTP request to another server, for fastify
Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of the ContentType header with additional whitespace and charset information. An attacker can bypass security checks by crafting a header that exploits this behavior.
References
CVSS Scores
version 3.1