Cpe:2.3:a:fastify:reply-From:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afastifyreply-from/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 11:28:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFastify: @fastify/reply-from path traversal (CVE-2026-117518)https://feed.craftedsignal.io/briefs/2026-11-fastify-reply-from-traversal/Mon, 02 Nov 2026 11:28:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fastify-reply-from-traversal/The @fastify/reply-from plugin contains a path traversal vulnerability where backslash dot-segments allow attackers to bypass proxy prefix constraints, enabling unauthorized access to unintended upstream endpoints.The @fastify/reply-from plugin (versions up to and including 12.8.0) fails to properly validate proxy paths containing backslash dot-segments. The WHATWG URL parser used by the plugin normalizes these backslashes to forward slashes, bypassing security guards intended to scope proxying to specific upstream prefixes. An attacker can exploit this to access restricted upstream API endpoints. The vulnerability is fixed in version 12.8.1.

Impact

Successful exploitation allows unauthenticated users to escape intended proxy boundaries, resulting in unauthorized access to unintended upstream resources. This is primarily a confidentiality impact with limited integrity impact.

Recommendation

Update the @fastify/reply-from package to version 12.8.1 or later. There are no available workarounds.

]]>highadvisory