Unauthorized Access Vulnerability in Fastify Plugin @fastify/reply-from

CVE-2026-117518

What is CVE-2026-117518?

The @fastify/reply-from plugin for Fastify allows unauthorized access to upstream resources due to improper validation of proxy paths. Versions up to 12.8.0 permit traversal by using backslash dot-segments, enabling requests that bypass intended routing controls. This flaw can result in retrieval of unintended data, affecting confidentiality. Version 12.8.1 addresses this issue by rejecting invalid path segments before URL construction, and users are urged to upgrade to this version or later.

References