@fastify/reply-from @fastify/http-proxy Schwachstellen (CVE)

Für @fastify/reply-from @fastify/http-proxy veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

1 Ergebnisse
9.0Kritisch
CVE-2026-33805

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

@fastify/reply-from @fastify/reply-from; @fastify/reply-from @fastify/http-proxy; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Red Hat OpenShift AI (RHOAI)

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fr…