CVE-2023-51701 MEDIUM

CVE-2023-51701: @fastify-reply-from JSON Content-Type parsing confusion

Vendor Fastify
Product fastify-reply-from
Weakness CWE-444
Published January 8, 2024
Last update June 3, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.

Key dates

02Disclosure timeline

January 8, 2024 CVE published
June 3, 2025 Record updated