Skip to content

@fastify/reply-from vulnerabilities

Products

Newest

@fastify/reply-from @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape CVE-2026-117518 8.2 HighNovember 2, 2026
@fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via decoded route parameters CVE-2026-120213 9.1 CriticalNovember 2, 2026
@fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments CVE-2026-120214 5.9 MediumNovember 2, 2026
@fastify/reply-from @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports CVE-2026-107318 7.4 HighOctober 8, 2026
@fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments CVE-2026-85124 7.5 HighSeptember 3, 2026
@fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters CVE-2026-16117 10.0 CriticalJuly 18, 2026
@fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal CVE-2026-15631 8.7 HighJuly 18, 2026
@fastify/reply-from, fastify fastify\/reply-from +1 more @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision CVE-2026-16158 8.7 HighJuly 18, 2026
@fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVE-2026-33805 Fix available 9.0 CriticalApril 15, 2026