Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prefix escape
Vulnerability Description
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability Type
输入验证不恰当
Vulnerability Title
fastify-http-proxy 输入验证错误漏洞
Vulnerability Description
Docs fastify-http-proxy是 （Docs）开源的一个应用软件。用于将将收到的所有带有给定前缀（或不带前缀）的请求转发给上游。 fastify-http-proxy 存在安全漏洞，该漏洞源于通过创建特定的URL，可以转义代理后端服务的前缀。
CVSS Information
N/A
Vulnerability Type
N/A