{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afastifyreply-from/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fastify:reply-from:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-117518"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@fastify/reply-from (\u003c= 12.8.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fastify"],"content_html":"\u003cp\u003eThe @fastify/reply-from plugin (versions up to and including 12.8.0) fails to properly validate proxy paths containing backslash dot-segments. The WHATWG URL parser used by the plugin normalizes these backslashes to forward slashes, bypassing security guards intended to scope proxying to specific upstream prefixes. An attacker can exploit this to access restricted upstream API endpoints. The vulnerability is fixed in version 12.8.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated users to escape intended proxy boundaries, resulting in unauthorized access to unintended upstream resources. This is primarily a confidentiality impact with limited integrity impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the @fastify/reply-from package to version 12.8.1 or later. There are no available workarounds.\u003c/p\u003e\n","date_modified":"2026-11-02T11:28:47Z","date_published":"2026-11-02T11:28:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fastify-reply-from-traversal/","summary":"The @fastify/reply-from plugin contains a path traversal vulnerability where backslash dot-segments allow attackers to bypass proxy prefix constraints, enabling unauthorized access to unintended upstream endpoints.","title":"Fastify: @fastify/reply-from path traversal (CVE-2026-117518)","url":"https://feed.craftedsignal.io/briefs/2026-11-fastify-reply-from-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fastify:reply-From:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}