Cookie leakage between different users in fastapi-proxy-lib
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact In the implementation of version `0.0.1`, requests from different user clients are processed using a shared `httpx.AsyncClient`. However, one oversight is that the `httpx.AsyncClient` will persistently store cookies based on the `set-cookie` response header sent by the target server and share these cookies across different user requests. This results in a cookie leakage issue among all user clients sharing the same `httpx.AsyncClient`. ### Patches It's fixed in `0.1.0` ### Workarounds If you insist `0.0.1`: - Do not use `ForwardHttpProxy` at all. - Do not use `ReverseHttpProxy` or `ReverseWebSocketProxy` for any servers that may potentially send a `set-cookie` response. **However, it's best to upgrade to the latest version.** ### References fixed in [#10](https://github.com/WSH032/fastapi-proxy-lib/pull/10)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | fastapi-proxy-lib (PyPI) | before 0.1.0 | 0.1.0 | Patch available | GHSA-7vwr-g6pm-9hc8 |
- fastapi-proxy-lib (PyPI) Vendor— Affected before 0.1.0 Fixed in 0.1.0 Patch available GHSA-7vwr-g6pm-9hc8
Remediation
- Fix · GHSA-7vwr-g6pm-9hc8 fastapi-proxy-lib (PyPI) Fixed in 0.1.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-7vwr-g6pm-9hc8
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences