https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:12:35.327554+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22112 EUVD-2026-22112 2026-10-03T06:12:35.402065+00:00 EUVD-2026-22112 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21322 fkie_cve-2021-21322 2026-10-03T06:12:35.402102+00:00

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.

 https://cve.radiocsirt.org/vuln/ghsa-c4qr-gmr9-v23w GHSA-c4qr-gmr9-v23w — Prefix escape 2026-10-03T06:12:35.402136+00:00

Affected: npm: fastify-http-proxy

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

All releases after v4.3.1 include the fix.

### Workarounds

There are no workaround available.

### For more information If you have any questions or comments about this advisory: * Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from) * Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)

 https://cve.radiocsirt.org/vuln/gsd-2021-21322 gsd-2021-21322 2026-10-03T06:12:35.402169+00:00 gsd-2021-21322 https://cve.radiocsirt.org/vuln/rhsa-2021:1168 RHSA-2021:1168 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update 2026-10-03T06:12:35.402182+00:00

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag go-slug: partial protection against zip slip attacks fastify-reply-from: crafted URL allows prefix scape of the proxied backend service fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service nodejs-lodash: command injection via template openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash()