-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @fastify/reply-from | npm | < 9.6.0 | 9.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the code in index.js that handled Content-Type parsing before the patch. The original implementation split on ';' but didn't trim whitespace, while the patched version switched to using fast-content-type-parse. The vulnerable code path was in the request body handling logic where Content-Type validation determined JSON encoding. The function's manual parsing logic created a discrepancy between fastify's core and reply-from's interpretation of Content-Type headers, enabling request smuggling via malformed headers.
Ongoing coverage of React2Shell