Vulnerability · Published Jan 8, 2024 · Assigned by GitHub_M
CVE-2023-51701@fastify-reply-from JSON Content-Type parsing confusion
Medium 5.3
In plain English
A medium-severity security flaw in fastify-reply-from from fastify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @fastify/reply-from | 9.6.0 | GHSA-v2v2-hph8-q5xp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fastify | fastify-reply-from | < 9.6.0 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N