Live › vulnerability › CVE-2026-117518
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream server. Up to and including 12.8.0, a path using backslash dot-segments slips past the traversal check and reaches other upstream paths, so an unauthenticated request can escape the intended prefix.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 11:22 UTC. All times on this page are UTC.
Applications that use @fastify/reply-from to forward requests to an upstream server and rely on a path prefix or route guards to limit what is reachable. Exposure is highest when the proxy is reachable without authentication. Applications that do not use the plugin, or that forward to a single fixed upstream with no prefix scoping, are less exposed.
No product ranges from the sources yet.
npm ls @fastify/reply-from or cat node_modules/@fastify/reply-from/package.jsonreply.from(...) or the plugin's proxy routes that scope forwarding to an upstream prefix@fastify/reply-from upgrade to 12.8.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.
This page as .md · .json · in your agent: get_signal("CVE-2026-117518")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.