Description

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.

Remediation

References

https://snyk.io/vuln/SNYK-JS-FASTHTTP-572892

Related Vulnerabilities

CVE-2021-41109 Vulnerability in npm package parse-server

CVE-2022-31127 Vulnerability in npm package next-auth

CVE-2012-5812 Vulnerability in maven package ch.acra:acra

CVE-2020-28052 Vulnerability in maven package org.bouncycastle:bcprov-jdk15to18

CVE-2020-27216 Vulnerability in maven package jetty:jetty

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory