Fastify: @fastify/reply-from path traversal (CVE-2026-117518)
The @fastify/reply-from plugin contains a path traversal vulnerability where backslash dot-segments allow attackers to bypass proxy prefix constraints, enabling unauthorized access to unintended upstream endpoints.
CVE search metadata
CVE search record: CVE-2026-117518. Severity: high. CVSS: 8.2. KEV: no. Product: @fastify/reply-from (<= 12.8.0). Brief: Fastify: @fastify/reply-from path traversal (CVE-2026-117518). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fastify-reply-from-traversal/
Triage facts
Revision 1- Applicability
- @fastify/reply-from (<= 12.8.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 11:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The @fastify/reply-from plugin (versions up to and including 12.8.0) fails to properly validate proxy paths containing backslash dot-segments. The WHATWG URL parser used by the plugin normalizes these backslashes to forward slashes, bypassing security guards intended to scope proxying to specific upstream prefixes. An attacker can exploit this to access restricted upstream API endpoints. The vulnerability is fixed in version 12.8.1.
Impact
Successful exploitation allows unauthenticated users to escape intended proxy boundaries, resulting in unauthorized access to unintended upstream resources. This is primarily a confidentiality impact with limited integrity impact.
Recommendation
Update the @fastify/reply-from package to version 12.8.1 or later. There are no available workarounds.
Immediate actions
Upgrade @fastify/reply-from to 12.8.1 or later
Threat Hunt
Identify access logs showing request paths with backslashes or encoded backslash sequences (%5C) targeting applications that use @fastify/reply-from
Data: Web server access logs
Mitigations
Update vulnerable packages to version 12.8.1
CVE-2026-117518