https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T00:12:23.450378+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22114 EUVD-2026-22114 2026-10-05T00:12:23.455122+00:00 EUVD-2026-22114 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21321 fkie_cve-2021-21321 2026-10-05T00:12:23.455154+00:00

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.

 https://cve.radiocsirt.org/vuln/ghsa-qmw8-3v4g-gwj4 GHSA-qmw8-3v4g-gwj4 — Prefix escape 2026-10-05T00:12:23.455188+00:00

Affected: npm: fastify-reply-from

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

A patch have been submitted by Corey Farrell git@cfware.com, the reporter. All releases after v4.0.2 include the fix.

### Workarounds

There are no workaround available.

### For more information If you have any questions or comments about this advisory: * Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from) * Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)

 https://cve.radiocsirt.org/vuln/gsd-2021-21321 gsd-2021-21321 2026-10-05T00:12:23.455244+00:00 gsd-2021-21321 https://cve.radiocsirt.org/vuln/rhsa-2021:1168 RHSA-2021:1168 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update 2026-10-05T00:12:23.455261+00:00

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag go-slug: partial protection against zip slip attacks fastify-reply-from: crafted URL allows prefix scape of the proxied backend service fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service nodejs-lodash: command injection via template openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash()