CRITICAL🇵🇱 Wersja polska

CVE-2026-33805

CVSS 9.0v4.0pub. 2026-04-15upd. 2026-06-30

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Fastify Fastify\/http Proxy

    APP
    Fastify
    < 11.4.4

  • Fastify Reply From

    APP
    Fastify
    < 12.6.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-66415MEDIUM6.9ten sam produkt

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0,...

CVE-2023-51701MEDIUM5.3ten sam produkt

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy ...

CVE-2026-14198CRITICAL9.1ten sam vendor

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before ...

CVE-2026-6556CRITICAL9.1ten sam vendor

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the...

CVE-2026-6270CRITICAL9.1PL ✓ten sam vendor

Pominięcie uwierzytelnienia w @fastify/middie — brak dziedziczenia middleware