packages:
  - module: github.com/valyala/fasthttp
    symbols:
      - FS.NewRequestHandler
    versions:
      - fixed: 1.34.0
    vulnerable_at: 1.33.0
description: |
    The fasthttp.FS request handler is vulnerable to directory traversal
    attacks on Windows systems, and can serve files from outside the
    provided root directory.

    URL path normalization does not handle Windows path separators
    (backslashes), permitting an attacker to construct requests
    with relative paths.
cves:
  - CVE-2022-21221
ghsas:
  - GHSA-fx95-883v-4q4h
credit: egovorukhin
links:
    commit: https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1
    context:
      - https://github.com/valyala/fasthttp/issues/1226
      - https://github.com/valyala/fasthttp/releases/tag/v1.34.0
      - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866