@fastify/reply-from CVE-2026-117518

Exploitation requires the consuming application to pass untrusted input into the proxied path AND rely on prefix scoping or Fastify route guards to constrain it - the advisory names the exact vulnerable pattern reply.from('/v1/public/' + req.params['*']). The attacker supplies backslash dot-segments (raw \..\ or percent-encoded %5c..%5c) in the user-controlled segment; this only works on the http, https, ws, and wss schemes where the WHATWG URL parser normalizes backslash to forward slash. Limiting factors: applications that do not concatenate untrusted input into the forward path, or that enforce upstream authorization independently of the proxy prefix, are not exploitable despite running an affected version. Exploitation is unauthenticated (PR:N) against the vulnerable usage pattern; there is no workaround other than upgrading to 12.8.1.

This is a genuine but conditional priority, not a blanket critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which drives the 8.2 base score, with impact weighted toward confidentiality (C:H) and only limited integrity (I:L) and no availability impact - consistent with a path-traversal/prefix-escape that exposes unintended upstream resources rather than enabling code execution. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with the absence of CISA KEV listing and the lack of any confirmed public exploit code. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The most important caveat is that the high score assumes a vulnerable usage pattern: the real-world risk depends entirely on whether the consuming application concatenates untrusted input into the forwarded path and relies on prefix scoping or route guards (see exploitation_conditions). Applications using @fastify/reply-from without user-controlled path segments are not meaningfully exposed despite the high base score.

An application proxies only a public subtree to an upstream using a scoped call such as reply.from('/v1/public/' + req.params['*']). An unauthenticated attacker sends a request whose wildcard segment contains backslash dot-segments (raw \..\ or percent-encoded %5c..%5c); the plugin's forward-slash-only traversal check passes, the WHATWG URL parser normalizes the backslashes to forward slashes, and the request escapes the /v1/public/ prefix to reach other upstream endpoints. No public exploit code is identified at time of analysis, though the mechanism is fully described in the GHSA advisory.