Fastify Reply From
Monthly
TLS certificate verification bypass in @fastify/reply-from versions prior to 12.7.0 allows an on-path attacker to impersonate the configured HTTPS upstream, intercept forwarded credentials and request bodies, and return forged responses. The plugin's built-in HTTPS transports override the secure default by setting rejectUnauthorized to false, so even in the default configuration with an https:// upstream, the proxy fails to validate the upstream's certificate. No public exploit identified at time of analysis. Upgrade to 12.7.0 or apply documented workarounds.
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
TLS certificate verification bypass in @fastify/reply-from versions prior to 12.7.0 allows an on-path attacker to impersonate the configured HTTPS upstream, intercept forwarded credentials and request bodies, and return forged responses. The plugin's built-in HTTPS transports override the secure default by setting rejectUnauthorized to false, so even in the default configuration with an https:// upstream, the proxy fails to validate the upstream's certificate. No public exploit identified at time of analysis. Upgrade to 12.7.0 or apply documented workarounds.
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.