Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by openjs

CVE-2026-33805@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

High 7.4

In plain English

A high-severity security flaw in @fastify/http-proxy from @fastify/reply-from. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 61.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@fastify/http-proxy11.4.4GHSA-gwhp-pf74-vj37
npm@fastify/reply-from12.6.2GHSA-gwhp-pf74-vj37

Affected products (as reported)

VendorProductVersions
@fastify/reply-from @fastify/reply-from 0 – before 12.6.2
@fastify/reply-from @fastify/http-proxy 0 – before 11.4.4

Weakness: CWE-644, CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References