fastify reply-from vulnerabilities (CVE)

CVE records published for fastify reply-from, newest first. Follow to get an email when a new one appears.

2 results

9.0Critical

CVE-2026-33805 7 months ago

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

@fastify/reply-from @fastify/reply-from; @fastify/reply-from @fastify/http-proxy; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Red Hat OpenShift AI (RHOAI)

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fr…

6.9Medium

CVE-2025-66415 11 months ago

fastify-reply-from bypass of reply forwarding

fastify fastify-reply-from

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fas…