@fastify/reply-from vulnerabilities
We track 4 vulnerabilities in @fastify/reply-from products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest @fastify/reply-from vulnerabilities
- 8.2 High severity
@fastify/reply-from: Improper Limitation of a Pathname to a Restricted Directory
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, wh
- 7.4 High severity
@fastify/reply-from: Improper Certificate Validation
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify
- 10.0 Critical severity
@fastify/reply-from: Unintended Proxy or Intermediary
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key whil
- 8.6 High severity
@fastify/reply-from: Improper Neutralization of HTTP Headers for Scripting Syntax
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fro