CVE-2023-51701 @fastify-reply-from JSON Content-Type parsing confusion
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-51701?
CVE-2023-51701 is a medium-severity vulnerability in fastify-reply-from, published on 8 Jan 2024.
Official description
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.
Weakness: CWE-444
Which versions are affected by CVE-2023-51701?
2 open source packages ship an affected version, including @fastify/reply-from. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/reply-from npm | All versions | 9.6.0 |
@fastify/reply-from npm | All versions | 9.6.0 |
Products include Fastify Reply-From.
How do I fix CVE-2023-51701?
Upgrade @fastify/reply-from to 9.6.0 or later.
Is CVE-2023-51701 being exploited?
There is no known exploitation of CVE-2023-51701 in the wild and no public exploit code.
Other vulnerabilities in fastify-reply-from
Sources
Also known as GHSA-v2v2-hph8-q5xp.