https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:23:27.153554+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-21322 CVE-2021-21322 — Prefix escape 2026-10-05T21:23:27.154618+00:00

Affected: fastify-http-proxy

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.