9.0
Critical
CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection…
Description
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/reply-from 12.6 | earliest → < 12.6.2 | 12.6.2 |
| @fastify/http-proxy 11.4 | earliest → < 11.4.4 | 11.4.4 |
| Red Hat OpenShift Dev Spaces 3.27 1776795511 | earliest → < 1776795511 | 1776795511 |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
Other CVEs of @fastify/reply-from
The 4 CVEs of @fastify/reply-from →
CVE-2026-117518
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server
8.2
High
CVE-2026-107318
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server
7.4
High
CVE-2026-16158
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by…
8.7
High