{"id":"GHSA-2q7r-29rg-6m5h","revision":"42d9b23272774c45a7ebb90a5b60caef","records":[{"revision":"42d9b23272774c45a7ebb90a5b60caef","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2q7r-29rg-6m5h","aliases":["CVE-2025-66415"],"title":"fastify-reply-from affected by bypass of reply forwarding","description":"### Summary\nBy crafting a malicious URL, an attacker could access routes that are not allowed, even though the `reply.from` is defined for specific routes in `@fastify/reply-from`.\n\n### Details\n\nAn attacker can bypass the route defined by the `@fastify/reply-from` package by adding a `..` symbol, which, for `curl` version `8.7.1`, is `%2e%2e`.\n\n### Impact\n\nEveryone is using this package with the routes option to protect a 3rd-party resource.","state":0,"publishedAt":"2025-12-02T00:38:57+00:00","modifiedAt":"2025-12-02T01:30:13.011305+00:00","affected":[{"ecosystem":"npm","name":"@fastify/reply-from","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"12.5.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-2q7r-29rg-6m5h","https://nvd.nist.gov/vuln/detail/CVE-2025-66415","https://github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66","https://github.com/fastify/fastify-reply-from"],"sourceUrl":"https://github.com/advisories/GHSA-2q7r-29rg-6m5h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2q7r-29rg-6m5h","identifiers":["GHSA-2q7r-29rg-6m5h","CVE-2025-66415"]},"retained":false,"historicalAffected":[]}],"coverage":[]}