CVE-2021-21321: fastify-reply-from_project fastify-reply-from Improper Input Validation
Vulnerability summary
CVE-2021-21321 is a critical (CVSS 10.0) Improper Input Validation vulnerability in fastify-reply-from_project fastify-reply-from. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.4% of scored vulnerabilities.
Timeline
- 02-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · NpmEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.82%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.82% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fastify1 product
- fastify-reply-from< 4.0.2
Fastify-reply-from_project1 product
- fastify-reply-from< 4.0.2
Npm1 product
- fastify-reply-from< 4.0.2
3 vendors · 3 products
References
4 links- github.com/fastify/fastify-reply-from/security/advisories/GHSA-qmw8-3v4g-gwj4X Refsource CONFIRMWEBThird Party Advisory
- github.com/fastify/fastify-reply-from/commit/dea227dda606900cc01870d08541b4dcc69d3889X Refsource MISCWEBPatchThird Party Advisory
