CVE-2023-51701
CVE-2023-51701 · @fastify-reply-from JSON Content-Type parsing confusion
This page contains facts from public vulnerability sources. Check the original advisory before updating.
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.
CVSS 5.3 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
fastify-reply-from
- Versions
- < 9.6.0: Affected
No fix published
@fastify/reply-from npm
- Affected ranges
- SEMVER: < 9.6.0
Update to 9.6.0