HTTP Request Smuggling Affecting @fastify/reply-from package, versions <9.6.0


Severity

0.0
medium
0
10

    Threat Intelligence

    EPSS
    0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-FASTIFYREPLYFROM-6146944
  • published 9 Jan 2024
  • disclosed 8 Jan 2024
  • credit qwerty472123

How to fix?

Upgrade @fastify/reply-from to version 9.6.0 or higher.

Overview

@fastify/reply-from is a forward your HTTP request to another server, for fastify

Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of the ContentType header with additional whitespace and charset information. An attacker can bypass security checks by crafting a header that exploits this behavior.

CVSS Scores

version 3.1
Expand this section

Snyk

5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

NVD

7.5 high