Skip to content
OpenAdvisories

Package · npm

@fastify/reply-from

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.0
    CVE-2026-33805

    @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

    @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fr…

    @fastify/reply-from @fastify/reply-from @fastify/http-proxy @fastify/reply-from npm
  • Medium 6.9
    CVE-2025-66415

    fastify-reply-from bypass of reply forwarding

    fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fas…

    fastify fastify-reply-from @fastify/reply-from npm
  • Medium 5.3
    CVE-2023-51701

    @fastify-reply-from JSON Content-Type parsing confusion

    fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. Th…

    fastify fastify-reply-from @fastify/reply-from npm