Skip to content
OpenAdvisories

Product · @fastify/reply-from

@fastify/http-proxy

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.0
    CVE-2026-33805

    @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

    @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fr…

    @fastify/reply-from @fastify/reply-from @fastify/http-proxy @fastify/reply-from npm