Ulisesgascon

When an Agent composes redirect and shared cache interceptors, a cached response revalidated with a conditional request may be incorrectly validated by a 304 Not Modified response from a different origin. This occurs because the redirect handler removes origin-bound credential headers but fails to remove cache-generated `If-None-Match` or `If-Modified-Since` validators. Consequently, the redirect destination receives the original origin's validator, and the system treats the 304 response as a successful revalidation. This can lead to a shared cache serving an authenticated response, such as one protected by an `Authorization` header, to an unauthenticated caller.

When the redirect interceptor and a shared response cache are used together, an authenticated request redirected to a same-origin target stores the final response under the original request's cache key. Because this key omits credentials and lacks a Vary header, subsequent requests from anonymous or different users may be served the private response body of the first user, leading to cross-user disclosure of cached private responses.

An issue exists in the HTTP client where the cache interceptor, when used with a downstream handler that throws during response processing, allows an asynchronous throw to escape as an uncaught exception or unhandled promise rejection. This occurs during the replay of a cached response, which terminates the Node.js process. A malicious or compromised HTTP server can trigger this by serving a cacheable response that causes a throw on replay, such as during a 304 revalidation of a stale entry, impacting system availability. Examples of handlers that may trigger this include the dump interceptor exceeding its `maxSize` or the decompress interceptor rejecting more than five Content-Encoding values.

The `fetch` function incorrectly verifies Subresource Integrity (SRI) metadata by splitting the integrity string only on single spaces. Because the SRI grammar allows any ASCII whitespace, including horizontal tabs, any digest preceded by such whitespace is treated as an unrecognized token and skipped. If no recognized algorithms remain, the integrity list is treated as empty, allowing a server to return a response body that differs from the pinned digest without triggering an integrity error. This allows an attacker who controls the response body to deliver malicious bytes to an application using whitespace-surrounded SRI values.

When an originless Agent composes redirect and shared cache interceptors, the system determines whether to store the final response under the original request key by inspecting only the final redirect hop. This allows a redirect that passes through an untrusted origin and returns to a trusted origin to be cached under the trusted key. Consequently, the `Vary` header of an intermediate hop may be dropped, potentially serving responses that vary on `Authorization` or `Cookie` to different users. Additionally, the `no-cache` or `default-uncacheable` status of an intermediate hop may be ignored, allowing a non-storable redirect to be treated as a cacheable entry. An attacker controlling a redirect target from a trusted URL could poison the cached entry or cause a private, per-user response to be served to subsequent callers.

The redirect interceptor fails to strip sensitive headers—including `Authorization`, `Cookie`, `Proxy-Authorization`, and `Host`—when a request is redirected to a different origin if the request headers are provided as an array of name and value tuples. In this scenario, the redirect handler misinterprets the tuples as a flat list, preventing the header names from matching and allowing sensitive headers to remain. If a header-normalizing interceptor, such as cache or deduplicate, is composed outside the redirect interceptor, these retained headers are serialized onto the cross-origin request, potentially disclosing origin-bound credentials to an unrelated destination.

This plugin forwards requests to an upstream HTTP server. It fails to properly validate proxy paths because it only checks for forward-slash dot-segments. The WHATWG URL parser normalizes backslashes and their percent-encoded forms into forward slashes for http, https, ws, and wss schemes. Consequently, a path using backslash dot-segments can bypass traversal checks, allowing unauthenticated requests to escape intended prefixes and access unintended upstream endpoints. This results in a confidentiality impact and limited integrity impact.

An application using the CORS plugin for the Fastify web framework may crash during a CORS preflight request if the plugin is registered with a non-default `onSend` hook option. When an OPTIONS request containing the Origin and Access-Control-Request-Method headers is received, the plugin calls `reply.send()` from within the `onSend` hook, causing the response headers to be written twice. This results in an uncaught ERR HTTP HEADERS SENT error that can terminate the Node.js process if no process-level handler is present. An unauthenticated remote client can trigger this state with a single preflight request, impacting system availability.

An issue exists where the plugin fails to propagate a parser error to the file stream when a request body ends within a file part without a closing boundary, provided the Content-Length is complete, the client does not abort, and no file size limit is exceeded. This causes the plugin to destroy the in-progress file stream without an error. Consequently, handlers performing asynchronous work before consuming the file attach to a stream that never emits an error or end event, leaving the request unresponsive while the connection remains open. An unauthenticated remote client can exploit this by sending repeated malformed uploads to exhaust server resources, leading to a Denial of Service (DoS), a condition where a service is unavailable to its intended users.

When configured with the signed cookie option, the plugin fails to stop processing when a signature check reports an invalid value. Instead, it passes the original cookie value to the session decoder, allowing a session with an invalid signature to be decrypted. This occurs if an application uses a cookie signing secret separate from the session encryption key and rotates only the signing secret. An attacker possessing an unexpired encrypted session cookie can strip the obsolete signature to continue using the session. The attacker cannot forge session data, extend expiry, or bypass rotation of the encryption key.

Destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path containing encoded backslashes and dot-segments to bypass the dot-segment check. If the upstream server treats a backslash as a path separator, the forwarded request can escape the configured proxy prefix to access sibling locations on the upstream. An unauthenticated remote attacker can exploit this to retrieve resources outside the intended prefix, impacting confidentiality.

When an application utilizes parameterized prefix and `rewritePrefix` options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into `rewritePrefix` without re-encoding them. An unauthenticated remote attacker can provide a parameter value encoding a path separator with a fragment or query delimiter. This decodes into actual separators and delimiters that inject additional upstream path segments and remove the mandatory suffix the `rewritePrefix` was intended to enforce. This allows the attacker to reach upstream locations outside the intended prefix, resulting in path-restriction bypass, which may lead to server-side request forgery (SSRF) or authorization bypass in the proxied service.

A denial of service issue exists when the server is configured with a nonzero `handlerTimeout` and a route returns a streaming response. If a request stream remains open beyond the timeout after headers have been sent, the server attempts to send a new error response. This triggers an uncaught `ERR HTTP HEADERS SENT` exception, which terminates the Node.js process and interrupts all other active requests. An unauthenticated remote client can trigger this by sending a single request to an affected streaming endpoint.

When the non-default `ignoreDuplicateSlashes` option is enabled, the plugin matches path-scoped Express middleware against a URL where duplicate-slash normalization collapses the separator after an absolute-form request target's scheme. This causes the Fastify router to resolve the request to the scoped path and execute the handler, while the Express layer fails to recognize the path. Consequently, an unauthenticated attacker can use an absolute-form target to access handlers on scoped routes, such as admin paths, bypassing middleware intended for authentication, authorization, or rate limiting.

With the default rolling session behavior, a request that restores a session before a logout can save its own copy after another request has completed the session destroy call. This allows the recreation of a destroyed session identifier along with its authenticated data. An attacker possessing a victim's valid signed session cookie can keep a request in flight during logout and replay that cookie to restore the session after it was intended to be revoked, without requiring cookie theft or signature forgery.

A race condition exists in the multipart parser when configured with an asynchronous `fileFilter()` function. If a request is aborted while an asynchronous `fileFilter()` is still pending, the callback may resume a parsing stream that has already been torn down. This causes the underlying parser to emit an error on a stream without an error listener, resulting in an unhandled error event that crashes the Node.js process, leading to a Denial of Service. This issue affects any application using an asynchronous `fileFilter()` regardless of the storage engine used.

When a proxy entry is configured to forward WebSockets, the server forwards non-HMR (Hot Module Replacement) WebSocket upgrade requests to the proxy target without validating the Host or Origin headers. This bypasses the allowedHosts protection. Consequently, a malicious web page visited by a developer can establish a cross-origin WebSocket connection through the development server to read from and write to the proxied backend, even if the server is bound to the loopback address.

An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pipes it into a decompression stream but fails to attach an error listener after reading the body. If a payload contains one valid compressed frame followed by trailing bytes, the application responds normally to the valid frame, but the trailing bytes trigger an error in the finished decoder. This error is re-thrown as an uncaught exception, terminating the process. Since body parsing occurs before routing, any endpoint that parses a body is affected.

The unauthenticated 'open-editor' endpoint validates the Host header using a regular expression designed for browser Origin schemes. A Host value starting with `file:` or an extension scheme can bypass the hostname and `allowedHosts` checks. A network peer can send a request with a malformed Host that passes validation, causing the endpoint's URL construction to fail. In default non-production mode, the server returns an HTTP 500 response containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers.

The `normalize()` and `serialize()` functions incorrectly apply RFC 3986 dot-segment removal to the path of a relative-path reference. This algorithm is intended only for the merged target path during resolution. Consequently, a leading parent-directory segment may be dropped, causing a document-relative reference to become root-relative. Applications that normalize user-supplied relative references before resolution or use them as cache, deduplication, or authorization keys may allow the reference to escape its intended directory and access a different resource.