{"id":"CVE-2026-117518","kind":"vulnerability","aliases":["CVE-2026-117518"],"related":[],"title":"@fastify/reply-from: backslash dot-segments bypass path checks, reaching other upstream endpoints","description":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.","summary":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream server. Up to and including 12.8.0, a path using backslash dot-segments slips past the traversal check and reaches other upstream paths, so an unauthenticated request can escape the intended prefix.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastify","node","npm","package","reverse-proxy"],"not_affected_if":["no-prefix-scoping","not-using-reply-from"],"how_to_check":"- Check the installed version with `npm ls @fastify/reply-from` or `cat node_modules/@fastify/reply-from/package.json`\n- Look for calls to `reply.from(...)` or the plugin's proxy routes that scope forwarding to an upstream prefix\n- Look for route guards placed in front of the forwarding call","fix":"- `@fastify/reply-from` upgrade to `12.8.1` or later","status":"open","published_at":"2026-11-02T11:17:30+00:00","first_seen_at":"2026-11-02T11:22:53+00:00","triaged_at":"2026-11-02T11:24:12+00:00","updated_at":"2026-11-02T11:24:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T11:24:12Z","model":"claude-haiku-5-5","output":{"fix":"- `@fastify/reply-from` upgrade to `12.8.1` or later","reach":"internet","title":"@fastify/reply-from: backslash dot-segments bypass path checks, reaching other upstream endpoints","impact":"medium","summary":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream server. Up to and including 12.8.0, a path using backslash dot-segments slips past the traversal check and reaches other upstream paths, so an unauthenticated request can escape the intended prefix.","audience":"developers","category":"package","nicknames":[],"who_cares":["fastify","node","reverse-proxy","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests reach unintended upstream endpoints, exposing confidential data","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @fastify/reply-from` or `cat node_modules/@fastify/reply-from/package.json`\n- Look for calls to `reply.from(...)` or the plugin's proxy routes that scope forwarding to an upstream prefix\n- Look for route guards placed in front of the forwarding call","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-reply-from","no-prefix-scoping"],"who_is_affected":"Applications that use @fastify/reply-from to forward requests to an upstream server and rely on a path prefix or route guards to limit what is reachable. Exposure is highest when the proxy is reachable without authentication. Applications that do not use the plugin, or that forward to a single fixed upstream with no prefix scoping, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4409,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117518':15A,18A '-2026':14A,17A '12.8.0':42B,88C '12.8.1':211C,246C 'access':191C 'along':227C 'ambigu':232C 'applic':156C 'backslash':2A,46B,115C,138C 'built':104C 'bypass':6A,143C 'call':174C 'charact':230C 'check':8A,54B,146C 'confidenti':199C 'construct':240C 'control':229C 'cve':13A,16A 'differ':151C 'dot':4A,48B,99C,140C,226C 'dot-seg':3A,47B,98C,139C 'doubl':225C 'encod':120C 'endpoint':12A,188C 'escap':65B,180C 'fastifi':19B,29B,72C 'fastify/reply-from':1A,26B,69C,210C 'fix':208C 'form':121C 'forward':32B,75C,96C,124C,173C 'forward-slash':95C 'front':170C 'guard':168C 'http':80C,128C 'https':129C 'impact':200C,204C 'includ':41B,87C 'integr':203C 'intend':67B,182C 'issu':206C 'later':248C 'limit':202C 'node':20B 'normal':113C,216C 'npm':21B 'packag':22B 'parser':111C 'past':51B 'path':7A,44B,59B,93C,135C,153C,214C 'percent':119C 'percent-encod':118C 'plugin':30B,73C,90C 'prefix':68B,163C,183C 'primarili':197C 'proxi':25B,92C,159C 'reach':9A,56B,185C 'reject':235C 'reli':165C 'request':33B,63B,76C,179C 'resolv':148C,220C 'resourc':195C 'result':190C 'revers':24B 'reverse-proxi':23B 'rout':167C 'scheme':133C 'scope':158C 'segment':5A,49B,100C,141C,219C 'server':37B,81C 'singl':223C 'slash':97C,125C 'slip':50B 'target':106C 'therefor':142C 'travers':53B,145C 'unauthent':62B,178C 'unintend':193C 'upgrad':244C,255C 'upstream':11A,36B,58B,79C,152C,162C,187C,194C 'url':110C,238C 'use':45B,137C 'user':242C 'valid':91C 'version':83C 'whatwg':109C 'whitespac':233C 'workaround':252C 'ws':130C 'wss':132C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @fastify/reply-from to forward requests to an upstream server and rely on a path prefix or route guards to limit what is reachable. Exposure is highest when the proxy is reachable without authentication. Applications that do not use the plugin, or that forward to a single fixed upstream with no prefix scoping, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fastify","high","node","npm","package","reverseproxy"],"first_public_at":"2026-11-02T09:02:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117518","severity":null,"published_at":"2026-11-02T11:17:30+00:00","modified_at":"2026-11-02T11:17:30+00:00","first_seen_at":"2026-11-02T11:22:53+00:00","fetched_at":"2026-11-02T11:22:53+00:00","note":null}],"documents":[{"id":51562,"url":"https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-vp2r-3vgv-32g9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T09:02:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}