fastify/fastify-reply-from · Security
fastify-reply-from affected by bypass of reply forwarding
- GHSA ID
- GHSA-2q7r-29rg-6m5h
- CVE ID
- CVE-2025-66415
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Summary
By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.
Details
An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl version 8.7.1, is %2e%2e.
Impact
Everyone is using this package with the routes option to protect a 3rd-party resource.
CWEs
- CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')