CVE-2022-21221: Path Traversal in github.com/valyala/fasthttp
Summary
CVE-2022-21221: Path traversal in github.com/valyala/fasthttp. Affects github.com/valyala/fasthttp versions < 1.34.0. Fixed in 1.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/valyala/fasthttp is a Go package that provides a fast and efficient HTTP client and server implementation. It is commonly used for building high-performance web applications. However, versions before 1.34.0 are vulnerable to a Directory Traversal issue in the ServeFile function. This vulnerability arises due to improper sanitization of user-supplied input. It specifically affects Windows users.
Vulnerability Detail
The vulnerability allows an attacker to perform a path traversal attack by using a backslash (%5c) character in the path. By exploiting this vulnerability, an attacker can access files outside of the intended directory and potentially disclose sensitive information. This can lead to unauthorized access, data leakage, and other security breaches. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: v1.76.0 as of 22 Oct 2026
go get github.com/valyala/fasthttp@v1.76.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.34.0
This is the first release that contains the fix.
go get github.com/valyala/fasthttp@v1.34.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually sanitize user input before passing it to the ServeFile function. This can be done by validating and normalizing the file path to ensure it only contains allowed characters and restricts access to the intended directory. Here is an example of how to sanitize the file path in Go:
import (
"github.com/valyala/fasthttp"
"path/filepath"
)
func sanitizePath(path string) string {
// Normalize the path
path = filepath.Clean(path)
// Restrict access to the intended directory
if !strings.HasPrefix(path, "/path/to/allowed/directory") {
path = "/path/to/allowed/directory"
}
return path
}
Conclusion
In conclusion, the package github.com/valyala/fasthttp before version 1.34.0 is vulnerable to a path traversal attack. This can be exploited by using a backslash character in the path, allowing unauthorized access to files outside of the intended directory. It is crucial to update to the latest version of the package or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/valyala/fasthttp →
FAQ
This vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access, data leakage, and other security breaches.
Windows users who are using versions of github.com/valyala/fasthttp before 1.34.0 are affected by this vulnerability.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-fx95-883v-4q4h/GHSA-fx95-883v-4q4h.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/valyala/fasthttp.
