FastChat Authentication Bypass Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.4
- Affected component
- fastchat (npm)
- Affected versions
- >= v0.2.36, <= v0.2.36 or >= v0.2.35, <= v0.2.35 or >= v0.2.34, <= v0.2.34 or >= v0.2.33, <= v0.2.33 or >= v0.2.32, <= v0.2.32 or >= v0.2.31, <= v0.2.31 or >= v0.2.30, <= v0.2.30 or >= v0.2.29, <= v0.2.29 or >= v0.2.28, <= v0.2.28 or >= v0.2.27, <= v0.2.27 or >= v0.2.26, <= v0.2.26 or >= v0.2.25, <= v0.2.25 or >= v0.2.23, <= v0.2.23 or >= v0.2.22, <= v0.2.22 or >= v0.2.21, <= v0.2.21 or >= v0.2.18, <= v0.2.18 or >= v0.2.14, <= v0.2.14 or >= v0.2.9, <= v0.2.9 or >= v0.2.5, <= v0.2.5 or >= v0.2.3, <= v0.2.3 or >= v0.2.1, <= v0.2.1 or >= v0.1.10, <= v0.1.10
- Patched version
- Not yet available
An authentication bypass vulnerability has been reported in the FastChat npm package. Users of affected versions are advised to monitor for patches.
What happened
FastChat reportedly contains a critical authentication bypass vulnerability in the /register_worker endpoint. This vulnerability allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers could potentially register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.
The vulnerability affects FastChat versions >= v0.2.36, <= v0.2.36 or >= v0.2.35, <= v0.2.35 or >= v0.2.34, <= v0.2.34 or >= v0.2.33, <= v0.2.33 or >= v0.2.32, <= v0.2.32 or >= v0.2.31, <= v0.2.31 or >= v0.2.30, <= v0.2.30 or >= v0.2.29, <= v0.2.29 or >= v0.2.28, <= v0.2.28 or >= v0.2.27, <= v0.2.27 or >= v0.2.26, <= v0.2.26 or >= v0.2.25, <= v0.2.25 or >= v0.2.23, <= v0.2.23 or >= v0.2.22, <= v0.2.22 or >= v0.2.21, <= v0.2.21 or >= v0.2.18, <= v0.2.18 or >= v0.2.14, <= v0.2.14 or >= v0.2.9, <= v0.2.9 or >= v0.2.5, <= v0.2.5 or >= v0.2.3, <= v0.2.3 or >= v0.2.1, <= v0.2.1 or >= v0.1.10, <= v0.1.10. Users of these versions should assess their exposure and prepare to upgrade once a patch is available.
The vulnerability is under investigation and has not been exploited in the wild. However, due to its critical nature, it is imperative to take immediate action to mitigate potential risks.
What to do about it
- Identify if your project uses the FastChat npm package and check the version.
- If you are using an affected version, monitor the FastChat project and NVD for updates on patches.
- Prepare to upgrade to the fixed version as soon as it is released.
- In the interim, consider implementing additional security measures to protect your application from potential attacks.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
fastchat is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using FastChat npm package versions >= v0.2.36, <= v0.2.36 or >= v0.2.35, <= v0.2.35 or >= v0.2.34, <= v0.2.34 or >= v0.2.33, <= v0.2.33 or >= v0.2.32, <= v0.2.32 or >= v0.2.31, <= v0.2.31 or >= v0.2.30, <= v0.2.30 or >= v0.2.29, <= v0.2.29 or >= v0.2.28, <= v0.2.28 or >= v0.2.27, <= v0.2.27 or >= v0.2.26, <= v0.2.26 or >= v0.2.25, <= v0.2.25 or >= v0.2.23, <= v0.2.23 or >= v0.2.22, <= v0.2.22 or >= v0.2.21, <= v0.2.21 or >= v0.2.18, <= v0.2.18 or >= v0.2.14, <= v0.2.14 or >= v0.2.9, <= v0.2.9 or >= v0.2.5, <= v0.2.5 or >= v0.2.3, <= v0.2.3 or >= v0.2.1, <= v0.2.1 or >= v0.1.10, <= v0.1.10.
What should I do right now?
Identify if your project uses the FastChat npm package and check the version. If you are using an affected version, monitor the FastChat project and NVD for updates on patches. Prepare to upgrade to the fixed version as soon as it is released. In the interim, consider implementing additional security measures to protect your application from potential attacks.
Is there a patch available?
No official fix has been published yet. Monitor the sources below for updates.