CVE-2021-21322 - CVE House
Back to Database
Status published Critical CVE-2021-21322

Prefix escape

Vulnerability Description

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21322

Credits & Attribution

No credits recorded in the NVD database.

References

More from fastify

View All →
CVE-2025-66415
fastify-reply-from bypass of reply forwarding
Medium 6.9
CVE-2025-32442
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
High 7.5
CVE-2025-24033
@fastify/multipart vulnerable to unlimited consumption of resources
High 7.5
CVE-2024-35220
@fastify/session reuses destroyed session cookie
High 7.4
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
High 7.4

Affected Vendor

Affected Software

fastify-http-proxy
Vulnerable Versions:
< 4.3.1

Timeline

Official Publish: March 2nd, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact