CVE-2026-117518
HighCVSS 8.2Summary
@fastify/reply-from versions up to and including 12.8.0 validate proxy paths only against forward-slash dot-segments, then build the target with the WHATWG URL parser, which normalizes backslash and its percent-encoded form to a forward slash. A path using backslash dot-segments bypasses the traversal check and resolves to a different upstream path. An unauthenticated request can escape the intended prefix and reach other upstream endpoints.
Risk Assessment
An attacker can access unintended upstream resources, primarily impacting confidentiality with limited integrity impact. The risk affects applications scoping proxying to an upstream prefix or relying on route guards.
Recommendation
Upgrade @fastify/reply-from to version 12.8.1 or later. There is no workaround other than upgrading.
Other vulnerabilities in @fastify/reply-from
See all- CVE-2026-107318High
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.
- CVE-2026-16158High
Vulnerability in @fastify/reply-from versions 8.3.1 up to but not including 12.6.4. The internal URL cache key is built by concatenating the destination and source path without a delimiter, leading to key collisions and requests being routed to the wrong upstream, enabling cross-upstream data access and modification.
- CVE-2026-33805High
A vulnerability in @fastify/reply-from (up to v12.6.1) and @fastify/http-proxy (up to v11.4.3) allows attackers to strip proxy-added headers after they have been added, by manipulating the Connection header. Clients can selectively remove headers used for routing, access control, or security.
- CVE-2025-66415Medium
Prior to version 12.5.0, the fastify-reply-from plugin allows an attacker to access routes that are not allowed by crafting a malicious URL, even though reply.from is defined for specific routes.
Original NVD description (English source)
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS