Fastify Reply From CVE-2026-33805

Remote exploitation against default network-accessible Fastify proxy configurations using @fastify/reply-from ≤12.6.1 or @fastify/http-proxy ≤11.4.3. Attack succeeds when the proxy uses rewriteRequestHeaders to add security-relevant headers (authentication tokens, client identifiers, authorization scopes, rate-limit keys) AND upstream services trust these headers for access control decisions without independent validation. CVSS AT:P (Attack Requirements Present) indicates attackers must identify which specific headers the proxy adds through reconnaissance (e.g., observing legitimate proxied requests or reviewing application documentation). No authentication required (PR:N). No user interaction needed (UI:N). Exploitation fails or has limited impact when upstream services use defense-in-depth (mutual TLS, signed tokens, independent authentication) rather than relying solely on proxy-inserted headers. Attack complexity is low (AC:L) once the target header names are known.

CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates network-based unauthenticated exploitation with low complexity but present attack requirements. The dual high-integrity scores (VI:H and SI:H) reflect impact on both the vulnerable proxy and subsequent upstream systems - a critical distinction for defense-in-depth architectures. EPSS 0.04% (13th percentile) suggests low observed exploitation activity despite proof-of-concept availability per SSVC. This apparent contradiction likely reflects the vulnerability's deployment-specific impact: exploitation only succeeds where upstream services trust proxy-added headers for access control. The SSVC 'Automatable: yes' classification is accurate for the exploitation mechanics but misleading for real-world impact - successful attacks require reconnaissance to identify which headers the target proxy adds and which upstream systems trust them. Priority depends on deployment: CRITICAL for proxies that add authentication/authorization headers relied upon by backend services (common in zero-trust architectures, multi-tenant SaaS, API gateways with header-based auth). MODERATE for basic reverse proxies where header manipulation causes logging issues rather than security bypasses. Missing data: No confirmation whether this affects default Fastify configurations or requires specific rewriteRequestHeaders implementations.

Attacker identifies a Fastify-based API gateway that adds X-Client-Auth: trusted-user to requests forwarded to internal microservices. The attacker sends an HTTP request with Connection: X-Client-Auth, causing @fastify/reply-from to strip the proxy-added authentication header. The upstream microservice receives the request without the expected auth header, either denying access (fail-safe) or defaulting to anonymous/low-privilege access. If the microservice improperly handles missing headers by granting default access, the attacker bypasses intended authentication controls. Proof-of-concept code exists per SSVC data.