TI-2021-04421 Aliases CVE-2021-21321 GHSA-qmw8-3v4g-gwj4

Prefix escape

MEDIUM 46CWE-20Published 2021-03-02 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.

Why it matters now

EPSS 0.01821 78th percentileScored 2026-11-07

Fix Partial fastify-reply-from (fastify): 4.0.2fastify-reply-from (npm): 4.0.2Red Hat: 1 advisoryRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	fastify-reply-from	before 4.0.2	4.0.2	Patch available	CNA
—	fastify-reply-from (npm)	before 4.0.2	4.0.2	Patch available	GHSA-qmw8-3v4g-gwj4

fastify-reply-from Vendorfastify Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
fastify-reply-from (npm) Vendor— Affected before 4.0.2 Fixed in 4.0.2 Patch available GHSA-qmw8-3v4g-gwj4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify-reply-from_project:fastify-reply-from::::::node.js::*	before 4.0.2	Vulnerable	Fastify-reply-from Project

cpe:2.3:a:fastify-reply-from_project:fastify-reply-from:*:*:*:*:*:node.js:*:* Versions before 4.0.2 Vulnerable ·Fastify-reply-from Project

Remediation

Fix · CNA fastify-reply-from (fastify) Fixed in 4.0.2
Fix · GHSA-qmw8-3v4g-gwj4 fastify-reply-from (npm) Fixed in 4.0.2 Advisory →

Red Hat 1 advisory

RHSA-2021:1168 Released 2021-04-13 · Red Hat rating Important
Red Hat Advanced Cluster Management 2.2.2 security and bug fix update
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2021-21321
2026-10-03 Alias added: GHSA-qmw8-3v4g-gwj4

References

Patch 1

https://github.com/fastify/fastify-reply-from/commit/dea227dda606900cc01870d08541b4dcc69d3889

Advisory 3

TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences