AIKIDO-2025-10638
github.com/valyala/fasthttp is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
20
Low Risk
This Affects:
github.com/valyala/fasthttpTL;DR
Affected versions of this package are vulnerable to Cache Poisoning via Incorrect HTTP Request Parsing due to a violation of RFC 9112 where the HTTP request line parser would incorrectly include extra whitespace characters as part of the request URI; when deployed behind a caching proxy, an attacker could exploit this by sending a request containing whitespace, which the proxy would interpret as a unique resource and cache the response, potentially allowing the poisoning of the cache for a legitimate URL without whitespace.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/valyala/fasthttp is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in versions 1.0.0 - 1.65.0.
How to fix this
Upgrade the github.com/valyala/fasthttp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant