Vulnerabilities

TI-2026-26177 CVE-2026-33805 · GHSA-gwhp-pf74-vj37

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

HIGH 78

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00441 Published 2026-04-15 Fixed in 12.6.2, 11.4.4 CWE-644

TI-2025-40851 CVE-2025-66415 · GHSA-2q7r-29rg-6m5h

fastify-reply-from bypass of reply forwarding

LOW 30

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00191 Published 2025-12-01 Partial fix · 12.5.0 CWE-441

TI-2023-28347 CVE-2023-51701 · GHSA-v2v2-hph8-q5xp

@fastify-reply-from JSON Content-Type parsing confusion

LOW 39

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2024-01-08 Fixed in 9.6.0 CWE-444

Vulnerabilities

Filters

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

fastify-reply-from bypass of reply forwarding

@fastify-reply-from JSON Content-Type parsing confusion