CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2023-51701
High (7.5) in fastify reply-from. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in @fastify/reply-from 9.6.0.
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fastify:reply-from
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v2v2-hph8-q5xp | npm | @fastify/reply-from | <9.6.0 | 9.6.0 |
References
- https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0
- https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp
- https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0
- https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp