Reply-from vulnerabilities

2 known vulnerabilities in Reply-from from Fastify. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  @fastify/reply-from: Improper Neutralization of HTTP Headers for Scripting Syntax

  CVE-2026-33805Apr 15, 2026@fastify/reply-from

  @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers fro

• 7.5 High severity

  fastify-reply-from: Inconsistent Interpretation of HTTP Requests

  CVE-2023-51701Jan 8, 2024Fastify

  fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. Thi