fastify

Records77All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

fastify records in CISA KEV

No fastify vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fastify 16 records HIGH Fastify-static 7 records MEDIUM Fastify/middie 7 records HIGH Fastify-multipart 5 records MEDIUM Fastify/http-proxy 4 records HIGH Fastify/busyboy 3 records MEDIUM Fastify/express 3 records HIGH Reply-from 3 records HIGH

Records

3 records in Reply-from · all components

TI-2026-26177 CVE-2026-33805 · GHSA-gwhp-pf74-vj37

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

HIGH 78

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00441 Published 2026-04-15 Fixed in 12.6.2, 11.4.4 CWE-644

TI-2023-28347 CVE-2023-51701 · GHSA-v2v2-hph8-q5xp

@fastify-reply-from JSON Content-Type parsing confusion

LOW 39

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2024-01-08 Fixed in 9.6.0 CWE-444

TI-2025-40851 CVE-2025-66415 · GHSA-2q7r-29rg-6m5h

fastify-reply-from bypass of reply forwarding

LOW 30

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00191 Published 2025-12-01 Partial fix · 12.5.0 CWE-441

Open these records in search →

Critical	16
High	37
Medium	22
Low	2
No CVSS	0