Use After Free in Fiber with Basic Auth

A Use After Free (UAF) vulnerability occurs when memory is accessed after it has been deallocated. In the context of a Fiber-based API using HTTP Basic Authentication, the interaction between request parsing, authentication state, and response generation can expose UAF risks when objects are retained or referenced beyond their intended lifetime.

Consider a Fiber route that authenticates using Basic Auth and then holds a reference to parsed credentials for later use, such as in middleware or deferred logging. If the credential object is freed (e.g., due to request-scoped garbage collection or manual cleanup) while a deferred operation still references it, a UAF condition can occur. This is particularly relevant when using context values or request-scoped storage that outlive the original request allocation.

For example, a handler might extract the username and password from the Basic Auth header, store them in the context for downstream logging, and then return a response. If the context is not properly scoped or the stored pointer is not duplicated, the underlying memory for the credentials could be freed between the time the handler returns and the deferred logging executes. When the logger attempts to read the credentials, it may access freed memory, leading to undefined behavior, data leakage, or crashes.

An attacker can exploit this by crafting rapid, concurrent requests with malformed or long Basic Auth headers, increasing the likelihood of timing conditions where memory is reused between request processing stages. The scanner checks for such unsafe patterns by correlating authentication checks with object lifetime analysis across the request lifecycle, flagging scenarios where credentials or context references persist beyond safe bounds.

Because Basic Auth credentials are often base64-encoded strings embedded in headers, improper memory handling during parsing or context attachment can create UAF conditions. The scanner’s 12 parallel checks—including Authentication, Input Validation, and Unsafe Consumption—work together to identify these risky code paths by cross-referencing spec definitions with runtime behavior, helping developers pinpoint where object lifetimes intersect with authentication logic.

To mitigate Use After Free risks when using Basic Authentication in Fiber, ensure credentials are copied into independently managed structures and avoid retaining pointers to request-scoped memory. Below are concrete code examples demonstrating safe patterns.

Insecure example that risks UAF by storing a pointer to request context:

const jwt = require('jsonwebtoken');
const { app } = require('fastify')();

app.get('/secure', (req, res) => {
  const authHeader = req.headers.authorization;
  if (authHeader && authHeader.startsWith('Basic ')) {
    const base64 = authHeader.split(' ')[1];
    const credentials = Buffer.from(base64, 'base64').toString('utf-8');
    const [user, pass] = credentials.split(':');
    // Risk: storing references that may become dangling
    req.context.user = user;
    req.context.pass = pass;
  }
});

Secure remediation that copies values and avoids lifetime issues:

const { app } = require('fastify')();

app.addHook('preHandler', async (req, reply) => {
  const authHeader = req.headers.authorization;
  if (authHeader && authHeader.startsWith('Basic ')) {
    const base64 = authHeader.split(' ')[1];
    const credentials = Buffer.from(base64, 'base64').toString('utf-8');
    const [user, pass] = credentials.split(':');
    // Safe: explicitly copy strings into request context
    req.setContext({
      user: String(user),
      pass: String(pass)
    });
  }
});

app.get('/secure', (req, res) => {
  const { user, pass } = req.getContext();
  // Use user/pass safely within the handler scope
  if (authenticate(user, pass)) {
    res.send({ status: 'ok' });
  } else {
    res.code(401).send({ error: 'Unauthorized' });
  }
});

function authenticate(user, pass) {
  // Replace with secure credential validation
  return user === 'admin' && pass === 'secret';
}

Additional recommendations include using middleware to validate and transform credentials early in the request lifecycle, avoiding context storage for sensitive values when possible, and leveraging Fiber’s built-in hooks to ensure objects are fully constructed before use. The middleBrick CLI can scan your Fiber endpoints with middlebrick scan <url> to detect UAF-prone patterns, while the Pro plan enables continuous monitoring to catch regressions as code evolves.