CVE-2021-21321: fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version…

PriorityP261critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

1.82%

76.1th percentile

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
fastify-reply-from_project	fastify-reply-from	< 4.0.2	4.0.2
fastify	fastify-reply-from	< 4.0.2	4.0.2
fastify	fastify-reply-from	>= 0 < 4.0.2	4.0.2

Detection & IOCsextracted from sources · hover to see the quote

→A crafted URL can be used to escape the configured prefix of the proxied backend service in fastify-reply-from, allowing access to paths outside the intended prefix (e.g., accessing '/priv' when only '/pub/' should be reachable). ↗
→Monitor HTTP proxy requests through fastify-reply-from for URL patterns that traverse outside the configured base path prefix, particularly requests reaching backend paths not under the expected prefix. ↗

·The vulnerability affects fastify-reply-from versions prior to 4.0.2. Upgrade to 4.0.2 or later to remediate. ↗
·The severity and impact of exploitation depends heavily on what backend endpoints are exposed; environments with unauthenticated or sensitive endpoints behind the proxy are at higher risk. ↗
·Red Hat Advanced Cluster Management for Kubernetes (rhacm2/search-ui-rhel8) is a confirmed affected package. ↗

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_redhat10.0CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.