EUVD-2026-45373Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable and unauthenticated (AV:N/PR:N), but requires engineering colliding cache keys in a multi-upstream setup (AC:H); crossing the upstream boundary is a scope change (S:C) with high confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.
AnalysisAI
Cross-upstream data exposure in @fastify/reply-from (the Fastify HTTP reverse-proxy plugin) versions 8.3.1 through 12.6.3 lets remote attackers read and modify data belonging to a different upstream than the one intended. Because the internal response-cache key is built by concatenating the destination and source paths without a delimiter, distinct upstream/path pairs can collide on the same key, so a response cached for upstream A is served for a request routed to upstream B. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a deployment where @fastify/reply-from serves more than one upstream and where getUpstream() selects the upstream dynamically from request data, with the internal URL cache enabled - which is the default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) reflects a network-reachable, unauthenticated issue with high confidentiality and integrity impact and a scope change - appropriate given the cross-upstream boundary crossing - but the AC:H flag is meaningful: exploitation depends on an attacker finding or forcing destination/source path pairs that collide on the same concatenated key and on the target using dynamic upstream selection, which raises effort and reduces reliability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application uses @fastify/reply-from as a gateway that routes to multiple upstream backends chosen from request data, with the default cache enabled. An attacker crafts requests whose destination and source path combinations concatenate to the same cache key as another tenant's upstream, causing the proxy to serve or accept data bound for a different backend and thereby leak or tamper with that upstream's responses. … |
| Remediation | Vendor-released patch: upgrade @fastify/reply-from to 12.6.4, which fixes the cache-key construction, and update the dependency (and any lockfile) accordingly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production Fastify services using @fastify/reply-from versions 8.3.1-12.6.3 and assess which have multiple upstream targets configured; search application logs for signs of cross-upstream response mixing such as inconsistent data patterns, misrouted responses, or backend data appearing in unintended contexts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fastify Reply From
View allfastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Ra
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today