Which versions of Fastify Reply From are affected by CVE-2026-33805?

HTTP header smuggling vulnerabilities in Fastify proxy modules (@fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3) allow unauthenticated attackers to strip security headers from proxied…. A patch is available.

How to fix or mitigate CVE-2026-33805?

Within 24 hours: Identify all applications using @fastify/reply-from or @fastify/http-proxy and document current versions. Within 7 days: Upgrade @fastify/reply-from to version 12.6.2 or later and @fastify/http-proxy to version 11.4.4 or later in all non-production environments, then conduct functional testing of proxy behavior and security header forwarding. Within 30 days: Deploy patched versions to all production systems and validate that security headers (authentication, authorization, routing headers) are correctly forwarded to upstream services.

Fastify Reply From CVE-2026-33805

Q: What is the CVSS score of CVE-2026-33805?

CVE-2026-33805 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22877 CRITICAL

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-04-15 openjs

GHSA-gwhp-pf74-vj37

Information Disclosure Fastify Reply From Fastify Http Proxy

9.0

CVSS 4.0 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Patch released

Apr 16, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 15, 2026 - 12:39 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22877

Analysis Generated

Apr 15, 2026 - 10:45 vuln.today

CVE Published

Apr 15, 2026 - 10:13 nvd

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 npm packages depend on @fastify/http-proxy (4 direct, 16 indirect)

Ecosystem-wide dependent count for version 11.4.4.

DescriptionCVE.org

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

AnalysisAI

HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.

Technical ContextAI

@fastify/reply-from is a Node.js library for proxying HTTP replies, commonly used in Fastify-based reverse proxies and API gateways. The vulnerability exploits RFC 9110 Connection header semantics, where clients can list headers to be removed during hop-by-hop processing. The flaw (CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax) occurs because the library processes the client-supplied Connection header AFTER the proxy's rewriteRequestHeaders callback has added its own headers. This timing issue enables attackers to name proxy-inserted headers (e.g., X-Forwarded-For, X-Auth-Token) in the Connection header, causing the library to strip them before forwarding the request upstream. @fastify/http-proxy (affected ≤11.4.3) inherits this vulnerability as it internally delegates to @fastify/reply-from. The attack subverts the proxy's intended security posture by removing headers that upstream services rely on for authorization decisions, rate limiting, or client identification.

RemediationAI

Upgrade @fastify/reply-from to version 12.6.2 or later, or upgrade @fastify/http-proxy to version 11.4.4 or later. For environments where immediate upgrade is not feasible, implement input validation to reject or sanitize client-supplied Connection headers before proxy processing - specifically strip any Connection header values that match names of proxy-added headers. This workaround carries performance overhead and requires maintaining an allowlist of proxy-inserted header names. Alternatively, configure upstream services to NOT rely solely on proxy-added headers for authentication/authorization decisions; use cryptographic signatures or mutual TLS for trust validation between proxy and upstream services, though this represents architectural rework rather than tactical mitigation. Organizations using affected versions should audit rewriteRequestHeaders callbacks to identify security-critical headers and assess upstream trust assumptions. Vendor advisories: https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37 and https://cna.openjsf.org/security-advisories.html. NVD reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33805.