URL cache key collision in @fastify/reply-from (CVE-2026-16158)

CVE-2026-16158 is a URL cache key collision vulnerability in @fastify/reply-from. The plugin constructs internal cache keys by concatenating the destination and source path without a delimiter, allowing different (destination, source) pairs to produce identical keys that resolve to different upstream URLs. When the getUpstream option is used to route between security-separated backends, an attacker who can influence the source path or upstream selection can cause requests to be silently forwarded to an unintended upstream, resulting in unauthorized cross-upstream data access and modification. Affected versions: - >= 8.3.1, < 12.6.4 We recommend updating to: 12.6.4. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v574-6498-x57v Details: https://vuln.today/cve/CVE-2026-16158