EUVD-2026-45373Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network, unauthenticated, no interaction, and scope-changed cross-upstream C/I impact; AC:H because it needs a multi-upstream dynamic-routing deployment plus attacker-crafted path pairs that actually collide.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.
AnalysisAI
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
Technical ContextAI
@fastify/reply-from is a Fastify plugin that forwards (reverse-proxies) incoming HTTP requests to one or more upstream services, commonly used to build API gateways and BFF layers in Node.js. To avoid recomputing target URLs, it maintains an internal cache keyed on the request routing; the defect is that the key is formed by string-concatenating the destination path and the source path without a separator (e.g. 'ab'+'c' collides with 'a'+'bc'). This is a classic CWE-441 (Unintended Proxy or Intermediary / confused deputy) condition, realized here as a cache-key aliasing bug: when getUpstream chooses the backend dynamically from request data, the ambiguous key causes the resolver to hand back a URL computed for a different upstream. The affected package is identified by cpe:2.3:a:@fastify/reply-from:@fastify/reply-from:*:*:*:*:*:*:*:* across 8.3.1 up to (not including) 12.6.4.
RemediationAI
Vendor-released patch: upgrade @fastify/reply-from to 12.6.4, which corrects the cache-key construction; this is the primary and recommended fix. If you cannot upgrade immediately, the vendor-documented workaround is to register the plugin with disableCache: true, which eliminates the colliding-key reuse at the cost of losing URL-resolution caching (a modest per-request CPU overhead and no functional change to routing). Operators should also audit whether upstreams are selected dynamically from request data, since that is the exposure condition. Refer to GHSA-v574-6498-x57v (https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v574-6498-x57v) and https://cna.openjsf.org/security-advisories.html for the authoritative guidance.
More in Fastify Reply From
View allfastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Ra
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today