CVE-2026-33805

HighCVSS 8.6

Published: 15/04/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

A vulnerability in @fastify/reply-from (up to v12.6.1) and @fastify/http-proxy (up to v11.4.3) allows attackers to strip proxy-added headers after they have been added, by manipulating the Connection header. Clients can selectively remove headers used for routing, access control, or security.

Risk Assessment

Attackers can bypass security mechanisms and access controls based on proxy-added headers, potentially leading to unauthorized access or traffic manipulation.

Recommendation

Upgrade @fastify/reply-from to version 12.6.2 or later and @fastify/http-proxy to version 11.4.4 or later immediately.

Other vulnerabilities in @fastify/reply-from

CVE-2026-16158High
Vulnerability in @fastify/reply-from versions 8.3.1 up to but not including 12.6.4. The internal URL cache key is built by concatenating the destination and source path without a delimiter, leading to key collisions and requests being routed to the wrong upstream, enabling cross-upstream data access and modification.

Original NVD description (English source)

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.