fastify-reply-from CVE-2026-16158

Exploitation requires the plugin to be deployed as a proxy that selects among MULTIPLE upstreams where getUpstream derives the target from request data (dynamic routing), with URL caching left at its default enabled state; the attacker must be able to control both the destination and source path components so that two different upstream mappings concatenate to the same delimiter-less cache key. Limiting factors: deployments with a single upstream, static routing, or disableCache:true are not exploitable, and only paths that produce a genuine key collision trigger the cross-upstream reuse. No authentication or user interaction is required (PR:N/UI:N) for a qualifying multi-upstream configuration.

The signals conflict and should be read together rather than in isolation. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) driven by network reach, no auth/interaction, and a scope change reflecting that one tenant's proxy can leak into another's data path. However, EPSS is only 0.23% (14th percentile), the CVE is not on CISA KEV, and no POC is referenced - so this is a high-severity-but-not-yet-demonstrated-at-scale issue rather than an active mass-exploitation threat. Critically, exploitability is gated by deployment: the bug only bites when the plugin routes to MULTIPLE upstreams selected from request data AND an attacker can induce the specific destination/source path pairs that collide into one cache key. Single-upstream or statically-routed deployments are not meaningfully exposed, which is why the low EPSS is consistent despite the perfect CVSS. Treat as an urgent patch for multi-tenant/multi-upstream gateways, and as lower practical priority for single-backend proxies.

An attacker sends a sequence of crafted HTTP requests to a Fastify gateway that dynamically proxies to several upstreams, choosing source/destination paths engineered to concatenate into a cache key already associated with a different backend. A subsequent legitimate or attacker request then resolves to the wrong upstream URL, letting the attacker read or modify data intended for another tenant/service. No public exploit is identified at time of analysis, and exploitation requires network reach to a multi-upstream deployment.