{"id":"CVE-2026-16158","aliases":["EUVD-2026-45373","GHSA-v574-6498-x57v"],"status":"published","title":"@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision","description":"Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00381,"percentile":0.32499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-441"],"published":"2026-07-18T12:28:17Z","modified":"2026-10-28T02:30:25Z","products":[{"vendor":"@fastify/reply-from","product":"@fastify/reply-from"},{"vendor":"fastify","product":"fastify\\/reply-from"}],"references":[{"url":"https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v574-6498-x57v","tags":["Vendor Advisory","advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16158.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16158","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-16158","title":"@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision","description":"Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.","status":"published","published":"2026-07-18T12:28:17.262Z","modified":"2026-07-20T15:15:50.016Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T14:20:10.870108Z"}],"euvd":[{"id":"EUVD-2026-45373","description":"Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.","status":"published","published":"2026-07-18T12:28:17Z","modified":"2026-07-20T15:15:50Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:48.530346Z"}],"nvd":[{"id":"CVE-2026-16158","description":"Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.","status":"published","published":"2026-07-18T13:17:06.03Z","modified":"2026-08-05T19:46:33.55Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-16158","title":"@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision","description":"Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.","status":"published","published":"2026-07-18T12:28:17.262Z","modified":"2026-10-28T02:30:25.484867867Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T15:44:57.682091Z"}]}}