9.0
Critique
CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection…
Description
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| @fastify/reply-from 12.6 | premières → < 12.6.2 | 12.6.2 |
| @fastify/http-proxy 11.4 | premières → < 11.4.4 | 11.4.4 |
| Red Hat OpenShift Dev Spaces 3.27 1776795511 | premières → < 1776795511 | 1776795511 |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Références
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de @fastify/reply-from
Les 4 CVE de @fastify/reply-from →
CVE-2026-117518
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server
8.2
Élevée
CVE-2026-107318
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server
7.4
Élevée
CVE-2026-16158
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by…
8.7
Élevée