Improper certificate validation in @fastify/reply-from transports
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.
Summary
Versions of @fastify/reply-from before 12.7.0 do not verify the TLS certificate of upstream servers. The built-in HTTPS transports override the secure default and set rejectUnauthorized to false, even in the default configuration. An on-path network attacker can impersonate the HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts (CWE-295).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| @fastify/reply-from | @fastify/reply-from | before 12.7.0 | 12.7.0 | Patch available | CNA |
- @fastify/reply-from Vendor@fastify/reply-from Affected before 12.7.0 Fixed in 12.7.0 Patch available CNA
Remediation
Upgrade @fastify/reply-from to version 12.7.0 or later, which fixes the issue. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA @fastify/reply-from (@fastify/reply-from) Fixed in 12.7.0
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107318
- 2026-10-09 CISA SSVC decision points changed
- 2026-10-09 Priority changed: MEDIUM → LOW
References
More @fastify/reply-from vulnerabilities
- TI-2026-83785 Path traversal in @fastify/reply-from via backslash dot-segments CVSS 3.1HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences