CVE-2026-33805

The proxy adds its own headers to the request (e.g., security, authorization, or routing headers) through the rewriteRequestHeaders function. Next, before the request reaches the upstream server, the Connection header provided by the client is processed. By standard, the Connection header indicates which headers are hop-by-hop and should be removed — an attacker can therefore place the names of headers added by the proxy in its value, causing their removal from the request before forwarding it further. As a result, the upstream never receives the headers added by the proxy.

An attacker can selectively remove headers responsible for access control, authentication, or security, which may lead to unauthorized access to upstream resources or bypass of security mechanisms enforced by the proxy.

Update @fastify/reply-from to version 12.6.2 or later and @fastify/http-proxy to version 11.4.4 or later.

@fastify/reply-from in version 12.6.1 and earlier and @fastify/http-proxy in version 11.4.3 and earlier