Fastify Reply From
Monthly
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.