Aliased fasthttp buffers can become stale or corrupted in the returned http.Request
high swesweep-fasthttp · fasthttpadaptor/request.go · ConvertRequest · run #4
Description
b2s converts fasthttp-owned request bytes into Go strings without copying for Method, Proto, Host, RequestURI, and header keys/values, r.Body wraps ctx.PostBody() without copying, and r.TLS stores a pointer into fasthttp/TLS state. Only the Cookie value is cloned. If the caller retains the http.Request, passes it to another goroutine after the fasthttp handler returns, or reuses the http.Request, fasthttp may reuse the underlying buffers for the next request. This can change header map keys/values, method, host, request target, or body contents, causing cross-request leakage, auth or header spoofing, request smuggling, or map-key corruption.
Triage
- Verdict
- INVALID confidence 0.0
- Model
- qwen/qwen3.8-27b
- Rounds
- 5
- Cost
- $0.0125 · 26.0 s
The reported vulnerability claims that `fasthttpadaptor.ConvertRequest` creates an `http.Request` with aliased memory (strings via `b2s`, body via `ctx.PostBody()`) which becomes stale if the `http.Request` is retained or used after the fasthttp handler returns. I verified that `b2s` performs an unsafe pointer cast to convert bytes to a string without copying, and `ctx.PostBody()` returns a slice into the fasthttp-owned buffer. The function `ConvertRequest` is a public API in a library context. However, the documentation for `ConvertRequest` explicitly states: 'The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!'. The provided threat model for the 'library' profile explicitly defines as **not a vulnerability**: 'misuse that violates a documented precondition of the public API'. Since the library correctly documents the lifetime constraint, any usage of the returned `http.Request` after the handler returns is a violation of this documented contract by the caller (developer error), not a security flaw exploitable by an external attacker through the public API within its defined trust boundaries. An attacker cannot force the library to violate its own documented preconditions; they can only influence the content of the request during the active handler lifetime. Therefore, under the binding threat model, this is INVALID. CRUX: The public API explicitly documents that the returned http.Request must not be used after the fasthttp handler returns, making post-handler use a violation of a documented precondition rather than a security vulnerability. GREP: The http.Request must not be used after the fasthttp handler has returned!
All rounds
[
{
"finding_title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"verdict": "INVALID",
"reasoning": "The reported vulnerability claims that `fasthttpadaptor.ConvertRequest` creates an `http.Request` containing string aliases (via `b2s`) and byte slice references (`ctx.PostBody()`) to fasthttp-owned memory, which becomes stale if the `http.Request` is retained or used after the fasthttp handler returns. I verified that `b2s` indeed performs unsafe pointer casting without copying (`unsafe.Pointer(&s[0])`), and that `ctx.PostBody()` returns a slice into the request context's buffer. The comment for `ConvertRequest` explicitly states: \"The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!\". The threat model specifies that \"misuse that violates a documented precondition of the public API\" is **not a vulnerability**. Since the API explicitly documents that the returned `http.Request` must not outlive the handler, an attacker cannot trigger this bug through normal, correct usage of the library; it is a developer error (violation of documented contract) rather than a security flaw in the library's handling of untrusted input. Thus, this is INVALID under the given threat model.\n\nCRUX: The public API explicitly documents that the returned http.Request must not be used after the handler returns, making the use of aliased memory a violation of a documented precondition rather than a security vulnerability exploitable by an external attacker.\nGREP: The http.Request must not be used after the fasthttp handler has returned!",
"elapsed": 5.4,
"tokens": 2733,
"tokens_in": 2405,
"tokens_out": 328,
"cost_usd": 0.0019941,
"file": "fasthttpadaptor/request.go",
"round": 1,
"grep_used": true,
"grep_results": "GREP `fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nbrotli.go:11:\t\"github.com/valyala/fasthttp/stackless\"\nbrotli.go:22:\t// See: https://github.com/valyala/fasthttp/issues/798#issuecomment-626293806\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:1:// Package fasthttpadaptor provides helper functions for converting net/http\nfasthttpadaptor/adaptor.go:2:// request handlers to fasthttp request handlers.\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/adaptor.go:14:\t\"github.com/valyala/fasthttp\"\nfasthttpadaptor/adaptor.go:17:// NewFastHTTPHandlerFunc wraps net/http handler func to fasthttp\nfasthttpadaptor/adaptor.go:18:// request handler, so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:20:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:21:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:24:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:26:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:28:// fasthttp handler.\nfasthttpadaptor/adaptor.go:30:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:31:// switching. Then manually convert net/http handlers to fasthttp handlers\nfasthttpadaptor/adaptor.go:32:// according to https://github.com/valyala/fasthttp#switching-from-nethttp-to-fasthttp .\nfasthttpadaptor/adaptor.go:33:func NewFastHTTPHandlerFunc(h http.HandlerFunc) fasthttp.RequestHandler {\nfasthttpadaptor/adaptor.go:37:// NewFastHTTPHandler wraps net/http handler to fasthttp request handler,\nfasthttpadaptor/adaptor.go:38:// so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:40:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:41:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:44:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:46:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:48:// fasthttp handler.\nfasthttpadaptor/adaptor.go:50:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:51:// switching. Then manually convert net/http handlers to fasthttp handlers\n```"
},
{
"finding_title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"verdict": "INVALID",
"reasoning": "The reported vulnerability relies on the assumption that an attacker can trigger memory corruption or data leakage by causing the caller to use the `http.Request` after the fasthttp handler returns. However, the function `ConvertRequest` is documented with the explicit precondition: 'The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!'. The provided threat model explicitly states that 'misuse that violates a documented precondition of the public API' is NOT a vulnerability. Since the library correctly documents the lifetime constraint of the returned object, and the aliasing is intentional for performance (a common trade-off in zero-copy adapters), the issue is a potential developer error if they violate the contract, not a security flaw in the library's handling of untrusted input within the defined trust boundary. An external attacker cannot force the library to violate its own documented preconditions; they can only send malformed requests, which the library is expected to handle within the scope of the request's active lifetime. Therefore, under the binding threat model, this is INVALID.\n\nCRUX: The API documents that the returned http.Request must not be used after the handler returns, making post-handler use a violation of a documented precondition rather than a security vulnerability.\nGREP: The http.Request must not be used after the fasthttp handler has returned",
"elapsed": 5.8,
"tokens": 3870,
"tokens_in": 3567,
"tokens_out": 303,
"cost_usd": 0.00240714,
"file": "fasthttpadaptor/request.go",
"round": 2,
"grep_used": true,
"grep_results": "GREP `fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nbrotli.go:11:\t\"github.com/valyala/fasthttp/stackless\"\nbrotli.go:22:\t// See: https://github.com/valyala/fasthttp/issues/798#issuecomment-626293806\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:1:// Package fasthttpadaptor provides helper functions for converting net/http\nfasthttpadaptor/adaptor.go:2:// request handlers to fasthttp request handlers.\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/adaptor.go:14:\t\"github.com/valyala/fasthttp\"\nfasthttpadaptor/adaptor.go:17:// NewFastHTTPHandlerFunc wraps net/http handler func to fasthttp\nfasthttpadaptor/adaptor.go:18:// request handler, so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:20:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:21:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:24:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:26:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:28:// fasthttp handler.\nfasthttpadaptor/adaptor.go:30:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:31:// switching. Then manually convert net/http handlers to fasthttp handlers\nfasthttpadaptor/adaptor.go:32:// according to https://github.com/valyala/fasthttp#switching-from-nethttp-to-fasthttp .\nfasthttpadaptor/adaptor.go:33:func NewFastHTTPHandlerFunc(h http.HandlerFunc) fasthttp.RequestHandler {\nfasthttpadaptor/adaptor.go:37:// NewFastHTTPHandler wraps net/http handler to fasthttp request handler,\nfasthttpadaptor/adaptor.go:38:// so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:40:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:41:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:44:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:46:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:48:// fasthttp handler.\nfasthttpadaptor/adaptor.go:50:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:51:// switching. Then manually convert net/http handlers to fasthttp handlers\n```"
},
{
"finding_title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"verdict": "INVALID",
"reasoning": "The reported vulnerability is based on the assumption that the `http.Request` returned by `ConvertRequest` can be safely used after the fasthttp handler returns. However, the code explicitly documents this constraint in the function comment: 'The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!'. The threat model rules for this profile state that 'misuse that violates a documented precondition of the public API' is NOT a vulnerability. Since the library provides clear documentation of the lifetime constraint, and the aliasing is a standard zero-copy optimization in such adapters, the issue described is a developer error (violating the contract) rather than a security flaw exploitable by an external attacker within the defined trust boundary. An external attacker cannot force the library to violate its own documented preconditions through network input; they can only influence the content of the request during the active handler lifetime, which is managed by the caller.\n\nCRUX: The public API explicitly documents that the returned http.Request must not be used after the handler returns, making the use of aliased memory a violation of a documented precondition rather than a security vulnerability.\nGREP: The http.Request must not be used after the fasthttp handler has returned",
"elapsed": 4.6,
"tokens": 4182,
"tokens_in": 3908,
"tokens_out": 274,
"cost_usd": 0.00246336,
"file": "fasthttpadaptor/request.go",
"round": 3,
"grep_used": true,
"grep_results": "GREP `fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nbrotli.go:11:\t\"github.com/valyala/fasthttp/stackless\"\nbrotli.go:22:\t// See: https://github.com/valyala/fasthttp/issues/798#issuecomment-626293806\nheader_timing_test.go:1:package fasthttp\nstreaming_test.go:1:package fasthttp\nstreaming_test.go:13:\t\"github.com/valyala/fasthttp/fasthttputil\"\nstreaming_test.go:30:\tln := fasthttputil.NewInmemoryListener()\nstreaming_test.go:105:func getChunkedTestEnv(t testing.TB) (*fasthttputil.InmemoryListener, []byte) {\nstreaming_test.go:126:\tln := fasthttputil.NewInmemoryListener()\nstreaming_test.go:164:\tln := fasthttputil.NewInmemoryListener()\nhttp_timing_test.go:1:package fasthttp\nround2_64_test.go:3:package fasthttp\nargs_test.go:1:package fasthttp\nbytesconv_32.go:3:package fasthttp\nipv6.go:1:package fasthttp\nworkerpool.go:1:package fasthttp\nround2_32.go:3:package fasthttp\ntcpdialer.go:1:package fasthttp\ntcpdialer.go:130:\t// var dialer = &fasthttp.TCPDialer{\ntcpdialer.go:382://\thc := fasthttp.HostClient{Addr: \"foo.com,bar.com\"}\ntcpdialer.go:385://\tvar dialErr *fasthttp.ErrDialWithUpstream\npprofhandler/pprof.go:1:// Package pprofhandler provides a fasthttp handler similar to net/http/pprof.\npprofhandler/pprof.go:9:\t\"github.com/valyala/fasthttp\"\npprofhandler/pprof.go:10:\t\"github.com/valyala/fasthttp/fasthttpadaptor\"\npprofhandler/pprof.go:14:\tcmdline = fasthttpadaptor.NewFastHTTPHandlerFunc(pprof.Cmdline)\npprofhandler/pprof.go:15:\tprofile = fasthttpadaptor.NewFastHTTPHandlerFunc(pprof.Profile)\npprofhandler/pprof.go:16:\tsymbol = fasthttpadaptor.NewFastHTTPHandlerFunc(pprof.Symbol)\npprofhandler/pprof.go:17:\ttrace = fasthttpadaptor.NewFastHTTPHandlerFunc(pprof.Trace)\n```"
},
{
"finding_title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"verdict": "INVALID",
"reasoning": "The reported vulnerability claims that `ConvertRequest` creates an `http.Request` with aliased memory (via `b2s` and direct slice references) which becomes stale if used after the fasthttp handler returns. I verified that `b2s` indeed performs unsafe pointer casting without copying, and `ctx.PostBody()` returns a slice into the context's buffer. Crucially, the public API documentation for `ConvertRequest` explicitly states: 'The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!'. The binding threat model for this library profile explicitly excludes from vulnerabilities: 'misuse that violates a documented precondition of the public API'. Since the library clearly documents the lifetime constraint of the returned object, using it after the handler returns is a developer error violating the contract, not a security flaw exploitable by an external attacker through the public API within its defined trust boundaries. An attacker cannot force the library to violate its own documented preconditions; they can only influence the content during the active handler lifetime, which is managed correctly by the library.\n\nCRUX: The public API explicitly documents that the returned http.Request must not be used after the fasthttp handler has returned, making post-handler use a violation of a documented precondition rather than a security vulnerability.\nGREP: The http.Request must not be used after the fasthttp handler has returned!",
"elapsed": 4.9,
"tokens": 4440,
"tokens_in": 4136,
"tokens_out": 304,
"cost_usd": 0.00264912,
"file": "fasthttpadaptor/request.go",
"round": 4,
"grep_used": true,
"grep_results": "GREP `fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nbrotli.go:11:\t\"github.com/valyala/fasthttp/stackless\"\nbrotli.go:22:\t// See: https://github.com/valyala/fasthttp/issues/798#issuecomment-626293806\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:1:// Package fasthttpadaptor provides helper functions for converting net/http\nfasthttpadaptor/adaptor.go:2:// request handlers to fasthttp request handlers.\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/adaptor.go:14:\t\"github.com/valyala/fasthttp\"\nfasthttpadaptor/adaptor.go:17:// NewFastHTTPHandlerFunc wraps net/http handler func to fasthttp\nfasthttpadaptor/adaptor.go:18:// request handler, so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:20:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:21:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:24:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:26:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:28:// fasthttp handler.\nfasthttpadaptor/adaptor.go:30:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:31:// switching. Then manually convert net/http handlers to fasthttp handlers\nfasthttpadaptor/adaptor.go:32:// according to https://github.com/valyala/fasthttp#switching-from-nethttp-to-fasthttp .\nfasthttpadaptor/adaptor.go:33:func NewFastHTTPHandlerFunc(h http.HandlerFunc) fasthttp.RequestHandler {\nfasthttpadaptor/adaptor.go:37:// NewFastHTTPHandler wraps net/http handler to fasthttp request handler,\nfasthttpadaptor/adaptor.go:38:// so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:40:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:41:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:44:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:46:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:48:// fasthttp handler.\nfasthttpadaptor/adaptor.go:50:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:51:// switching. Then manually convert net/http handlers to fasthttp handlers\n```"
},
{
"finding_title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"verdict": "INVALID",
"reasoning": "The reported vulnerability claims that `fasthttpadaptor.ConvertRequest` creates an `http.Request` with aliased memory (strings via `b2s`, body via `ctx.PostBody()`) which becomes stale if the `http.Request` is retained or used after the fasthttp handler returns. I verified that `b2s` performs an unsafe pointer cast to convert bytes to a string without copying, and `ctx.PostBody()` returns a slice into the fasthttp-owned buffer. The function `ConvertRequest` is a public API in a library context. However, the documentation for `ConvertRequest` explicitly states: 'The http.Request must not be used after the fasthttp handler has returned! Memory in use by the http.Request will be reused after your handler has returned!'. The provided threat model for the 'library' profile explicitly defines as **not a vulnerability**: 'misuse that violates a documented precondition of the public API'. Since the library correctly documents the lifetime constraint, any usage of the returned `http.Request` after the handler returns is a violation of this documented contract by the caller (developer error), not a security flaw exploitable by an external attacker through the public API within its defined trust boundaries. An attacker cannot force the library to violate its own documented preconditions; they can only influence the content of the request during the active handler lifetime. Therefore, under the binding threat model, this is INVALID.\n\nCRUX: The public API explicitly documents that the returned http.Request must not be used after the fasthttp handler returns, making post-handler use a violation of a documented precondition rather than a security vulnerability.\nGREP: The http.Request must not be used after the fasthttp handler has returned!",
"elapsed": 5.3,
"tokens": 4944,
"tokens_in": 4585,
"tokens_out": 359,
"cost_usd": 0.0030026999999999996,
"file": "fasthttpadaptor/request.go",
"round": 5,
"grep_used": true,
"grep_results": "GREP `fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nbrotli.go:11:\t\"github.com/valyala/fasthttp/stackless\"\nbrotli.go:22:\t// See: https://github.com/valyala/fasthttp/issues/798#issuecomment-626293806\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:1:// Package fasthttpadaptor provides helper functions for converting net/http\nfasthttpadaptor/adaptor.go:2:// request handlers to fasthttp request handlers.\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/adaptor.go:14:\t\"github.com/valyala/fasthttp\"\nfasthttpadaptor/adaptor.go:17:// NewFastHTTPHandlerFunc wraps net/http handler func to fasthttp\nfasthttpadaptor/adaptor.go:18:// request handler, so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:20:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:21:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:24:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:26:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:28:// fasthttp handler.\nfasthttpadaptor/adaptor.go:30:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:31:// switching. Then manually convert net/http handlers to fasthttp handlers\nfasthttpadaptor/adaptor.go:32:// according to https://github.com/valyala/fasthttp#switching-from-nethttp-to-fasthttp .\nfasthttpadaptor/adaptor.go:33:func NewFastHTTPHandlerFunc(h http.HandlerFunc) fasthttp.RequestHandler {\nfasthttpadaptor/adaptor.go:37:// NewFastHTTPHandler wraps net/http handler to fasthttp request handler,\nfasthttpadaptor/adaptor.go:38:// so it can be passed to fasthttp server.\nfasthttpadaptor/adaptor.go:40:// While this function may be used for easy switching from net/http to fasthttp,\nfasthttpadaptor/adaptor.go:41:// it has the following drawbacks comparing to using manually written fasthttp\nfasthttpadaptor/adaptor.go:44:// - A lot of useful functionality provided by fasthttp is missing\nfasthttpadaptor/adaptor.go:46:// - net/http -> fasthttp handler conversion has some overhead,\nfasthttpadaptor/adaptor.go:48:// fasthttp handler.\nfasthttpadaptor/adaptor.go:50:// So it is advisable using this function only for quick net/http -> fasthttp\nfasthttpadaptor/adaptor.go:51:// switching. Then manually convert net/http handlers to fasthttp handlers\n```"
}
]Raw scan report for this file
This file does not contain fixed-size buffer overflows, but it does have several security-relevant lifetime, state-management, and HTTP protocol handling issues in `ConvertRequest`.
Key concerns:
- `b2s` is used to convert fasthttp-owned byte buffers into Go strings without copying. As a result, `r.Method`, `r.Proto`, `r.Host`, `r.RequestURI`, header keys, header values, and related fields can alias fasthttp memory. The function only clones the Cookie value, not other header values or keys.
- `r.Body` wraps `ctx.PostBody()` without copying, and `r.TLS` stores a pointer to fasthttp/TLS state. If the caller retains the `http.Request`, passes it to a goroutine after the fasthttp handler returns, or reuses the `http.Request`, fasthttp may reuse the underlying buffers for the next request.
- The function appears to support reusing the same `http.Request` by clearing `r.Header`, but it does not reset `r.TransferEncoding`, and `r.RequestURI` is only overwritten when `forServer` is true. Stale protocol state can therefore survive into subsequent requests.
- Header conversion uses `r.Header.Set`, which collapses duplicate headers to the last value. HTTP allows repeated headers, so this can drop security-relevant values.
- Special header handling for `Transfer-Encoding` and `Cookie` is performed on the raw header name before canonicalization. HTTP header names are case-insensitive, so non-canonical spellings can bypass the special handling if fasthttp does not already normalize header names.
```json
[
{
"severity": "high",
"title": "Aliased fasthttp buffers can become stale or corrupted in the returned http.Request",
"function": "ConvertRequest",
"description": "b2s converts fasthttp-owned request bytes into Go strings without copying for Method, Proto, Host, RequestURI, and header keys/values, r.Body wraps ctx.PostBody() without copying, and r.TLS stores a pointer into fasthttp/TLS state. Only the Cookie value is cloned. If the caller retains the http.Request, passes it to another goroutine after the fasthttp handler returns, or reuses the http.Request, fasthttp may reuse the underlying buffers for the next request. This can change header map keys/values, method, host, request target, or body contents, causing cross-request leakage, auth or header spoofing, request smuggling, or map-key corruption."
},
{
"severity": "medium",
"title": "Stale TransferEncoding and RequestURI state when http.Request is reused",
"function": "ConvertRequest",
"description": "The function clears r.Header to allow reuse of the same http.Request, but it does not reset r.TransferEncoding, and it only overwrites r.RequestURI when forServer is true. An attacker can send a request with Transfer-Encoding or a server-side RequestURI followed by a request without that field; if the caller reuses r, the next converted request can still carry the previous value. This can confuse body handling, cause Content-Length/Transfer-Encoding confusion, or enable request smuggling in handlers or proxies that consume the converted request."
},
{
"severity": "medium",
"title": "Duplicate HTTP headers are collapsed instead of preserved",
"function": "ConvertRequest",
"description": "The header loop uses r.Header.Set(sk, sv), which replaces any existing value for the canonical key. HTTP permits repeated headers, and net/http normally preserves them. An attacker can send multiple Cookie, X-Forwarded-For, or other security-relevant headers; the conversion keeps only the last value, potentially dropping authentication tokens, altering proxy trust decisions, or facilitating header-spoofing and smuggling scenarios where the first or all values matter."
},
{
"severity": "medium",
"title": "Special header cases are matched before canonicalization and are case-sensitive",
"function": "ConvertRequest",
"description": "sk is compared to the literal Transfer-Encoding and fasthttp.HeaderCookie using the raw header name before http.Header.Set canonicalizes it. Because HTTP header field names are case-insensitive, a request can use a non-canonical spelling to bypass the special cases if fasthttp does not already normalize header names. The code should canonicalize sk with textproto.CanonicalMIMEHeaderKey(sk) before the switch and use the canonical name for the Cookie clone decision."
}
]
```