Mcollina

When an Agent composes redirect and shared cache interceptors, a cached response revalidated with a conditional request may be incorrectly validated by a 304 Not Modified response from a different origin. This occurs because the redirect handler removes origin-bound credential headers but fails to remove cache-generated `If-None-Match` or `If-Modified-Since` validators. Consequently, the redirect destination receives the original origin's validator, and the system treats the 304 response as a successful revalidation. This can lead to a shared cache serving an authenticated response, such as one protected by an `Authorization` header, to an unauthenticated caller.

When an originless Agent composes redirect and shared cache interceptors, the system determines whether to store the final response under the original request key by inspecting only the final redirect hop. This allows a redirect that passes through an untrusted origin and returns to a trusted origin to be cached under the trusted key. Consequently, the `Vary` header of an intermediate hop may be dropped, potentially serving responses that vary on `Authorization` or `Cookie` to different users. Additionally, the `no-cache` or `default-uncacheable` status of an intermediate hop may be ignored, allowing a non-storable redirect to be treated as a cacheable entry. An attacker controlling a redirect target from a trusted URL could poison the cached entry or cause a private, per-user response to be served to subsequent callers.

The redirect interceptor fails to strip sensitive headers—including `Authorization`, `Cookie`, `Proxy-Authorization`, and `Host`—when a request is redirected to a different origin if the request headers are provided as an array of name and value tuples. In this scenario, the redirect handler misinterprets the tuples as a flat list, preventing the header names from matching and allowing sensitive headers to remain. If a header-normalizing interceptor, such as cache or deduplicate, is composed outside the redirect interceptor, these retained headers are serialized onto the cross-origin request, potentially disclosing origin-bound credentials to an unrelated destination.

When the redirect interceptor and a shared response cache are used together, an authenticated request redirected to a same-origin target stores the final response under the original request's cache key. Because this key omits credentials and lacks a Vary header, subsequent requests from anonymous or different users may be served the private response body of the first user, leading to cross-user disclosure of cached private responses.

The `fetch` function incorrectly verifies Subresource Integrity (SRI) metadata by splitting the integrity string only on single spaces. Because the SRI grammar allows any ASCII whitespace, including horizontal tabs, any digest preceded by such whitespace is treated as an unrecognized token and skipped. If no recognized algorithms remain, the integrity list is treated as empty, allowing a server to return a response body that differs from the pinned digest without triggering an integrity error. This allows an attacker who controls the response body to deliver malicious bytes to an application using whitespace-surrounded SRI values.

An issue exists in the HTTP client where the cache interceptor, when used with a downstream handler that throws during response processing, allows an asynchronous throw to escape as an uncaught exception or unhandled promise rejection. This occurs during the replay of a cached response, which terminates the Node.js process. A malicious or compromised HTTP server can trigger this by serving a cacheable response that causes a throw on replay, such as during a 304 revalidation of a stale entry, impacting system availability. Examples of handlers that may trigger this include the dump interceptor exceeding its `maxSize` or the decompress interceptor rejecting more than five Content-Encoding values.

When configured with the signed cookie option, the plugin fails to stop processing when a signature check reports an invalid value. Instead, it passes the original cookie value to the session decoder, allowing a session with an invalid signature to be decrypted. This occurs if an application uses a cookie signing secret separate from the session encryption key and rotates only the signing secret. An attacker possessing an unexpired encrypted session cookie can strip the obsolete signature to continue using the session. The attacker cannot forge session data, extend expiry, or bypass rotation of the encryption key.

A denial of service issue exists when the server is configured with a nonzero `handlerTimeout` and a route returns a streaming response. If a request stream remains open beyond the timeout after headers have been sent, the server attempts to send a new error response. This triggers an uncaught `ERR HTTP HEADERS SENT` exception, which terminates the Node.js process and interrupts all other active requests. An unauthenticated remote client can trigger this by sending a single request to an affected streaming endpoint.

An application using the CORS plugin for the Fastify web framework may crash during a CORS preflight request if the plugin is registered with a non-default `onSend` hook option. When an OPTIONS request containing the Origin and Access-Control-Request-Method headers is received, the plugin calls `reply.send()` from within the `onSend` hook, causing the response headers to be written twice. This results in an uncaught ERR HTTP HEADERS SENT error that can terminate the Node.js process if no process-level handler is present. An unauthenticated remote client can trigger this state with a single preflight request, impacting system availability.

This plugin forwards requests to an upstream HTTP server. It fails to properly validate proxy paths because it only checks for forward-slash dot-segments. The WHATWG URL parser normalizes backslashes and their percent-encoded forms into forward slashes for http, https, ws, and wss schemes. Consequently, a path using backslash dot-segments can bypass traversal checks, allowing unauthenticated requests to escape intended prefixes and access unintended upstream endpoints. This results in a confidentiality impact and limited integrity impact.

An issue exists where the plugin fails to propagate a parser error to the file stream when a request body ends within a file part without a closing boundary, provided the Content-Length is complete, the client does not abort, and no file size limit is exceeded. This causes the plugin to destroy the in-progress file stream without an error. Consequently, handlers performing asynchronous work before consuming the file attach to a stream that never emits an error or end event, leaving the request unresponsive while the connection remains open. An unauthenticated remote client can exploit this by sending repeated malformed uploads to exhaust server resources, leading to a Denial of Service (DoS), a condition where a service is unavailable to its intended users.

When an application utilizes parameterized prefix and `rewritePrefix` options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into `rewritePrefix` without re-encoding them. An unauthenticated remote attacker can provide a parameter value encoding a path separator with a fragment or query delimiter. This decodes into actual separators and delimiters that inject additional upstream path segments and remove the mandatory suffix the `rewritePrefix` was intended to enforce. This allows the attacker to reach upstream locations outside the intended prefix, resulting in path-restriction bypass, which may lead to server-side request forgery (SSRF) or authorization bypass in the proxied service.

Destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path containing encoded backslashes and dot-segments to bypass the dot-segment check. If the upstream server treats a backslash as a path separator, the forwarded request can escape the configured proxy prefix to access sibling locations on the upstream. An unauthenticated remote attacker can exploit this to retrieve resources outside the intended prefix, impacting confidentiality.

When the non-default `ignoreDuplicateSlashes` option is enabled, the plugin matches path-scoped Express middleware against a URL where duplicate-slash normalization collapses the separator after an absolute-form request target's scheme. This causes the Fastify router to resolve the request to the scoped path and execute the handler, while the Express layer fails to recognize the path. Consequently, an unauthenticated attacker can use an absolute-form target to access handlers on scoped routes, such as admin paths, bypassing middleware intended for authentication, authorization, or rate limiting.

With the default rolling session behavior, a request that restores a session before a logout can save its own copy after another request has completed the session destroy call. This allows the recreation of a destroyed session identifier along with its authenticated data. An attacker possessing a victim's valid signed session cookie can keep a request in flight during logout and replay that cookie to restore the session after it was intended to be revoked, without requiring cookie theft or signature forgery.

The `normalize()` and `serialize()` functions incorrectly apply RFC 3986 dot-segment removal to the path of a relative-path reference. This algorithm is intended only for the merged target path during resolution. Consequently, a leading parent-directory segment may be dropped, causing a document-relative reference to become root-relative. Applications that normalize user-supplied relative references before resolution or use them as cache, deduplication, or authorization keys may allow the reference to escape its intended directory and access a different resource.

The software percent-decodes the scheme component using the legacy global `unescape()` function before validation. This allows inputs with percent-encoded schemes to be emitted as live schemes, contradicting RFC 3986. Applications that screen raw input for dangerous schemes but store or render the normalized result may inadvertently allow the creation of executable `javascript`, `data`, or `vbscript` URLs, leading to stored or reflected cross-site scripting. Additionally, the `equal()` function treats encoded and plain schemes as identical, which can be used to bypass equality-based allowlists.

When the `serialize()`, `normalize()`, or `resolve()` functions are called with the non-default `reference` option set to `suffix` on a reference lacking authority, the resulting relative reference may contain an unescaped bare colon in its first path segment. This violates RFC 3986, as it allows the string to be reparsed as an absolute URI with a scheme. Consequently, an application treating the result as a URI could convert inert input into active `javascript`, `data`, or `vbscript` URLs, creating a cross-site scripting vector. Additionally, the `equal()` function may incorrectly treat a scheme-bearing reference as a relative one. This issue only affects applications utilizing the non-default `suffix` reference option.

The `use()` function joins a path-scoped middleware mount path to the plugin scope prefix in a manner that may diverge from the path served by the Fastify router. This occurs primarily when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Such discrepancies cause the middleware to be silently skipped while the route handler continues to execute, potentially allowing a single unauthenticated request to bypass critical path-scoped middleware such as authentication, authorization, or rate limiting.

For HTTP-family schemes, the `canonicalizeHost()` function passes the parsed host to the WHATWG URL parser and adopts its hostname without verifying that the parser consumed the entire input as a host. This allows the authority to be silently rewritten by dropping data before an at-sign and stripping tab, carriage-return, and line-feed characters without reporting an error. Applications enforcing host-based policies, such as denylists, loopback filtering, redirect validation, or outbound proxy routing, may find that the canonical host diverges from the checked representation, potentially steering traffic to an unintended destination.