@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Source published

15 Apr 2026 10:13:25 UTC

Source modified

15 Jul 2026 01:06:04 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Source published

Apr 15, 2026, 10:13:25 AM (timezone not stated)

Source modified

Jul 15, 2026, 1:06:04 AM (timezone not stated)

Observed here

1 Nov 2026 05:16:03 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Source published

15 Apr 2026 11:16:34 UTC

Source modified

26 Oct 2026 22:10:00 UTC

Observed here

27 Oct 2026 09:02:55 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary · 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

### Summary `@fastify/reply-from` and `@fastify/http-proxy` process the client's `Connection` header after the proxy has added its own headers via `rewriteRequestHeaders`. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the `Connection` header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes. ### Details The vulnerability exists in `@fastify/reply-from/lib/request.js` at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is: 1. Client headers are copied including the `connection` header (`@fastify/reply-from/index.js` line 91) 2. The proxy adds custom headers via `rewriteRequestHeaders` (line 151) 3. During request construction, the transport handlers read the client's `Connection` header and strip any headers listed in it 4. This stripping happens after `rewriteRequestHeaders`, allowing clients to target proxy-added headers for removal RFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client's Connection header after the proxy has already modified the header set. The call chain: 1. `@fastify/reply-from/index.js` line 91: `headers = { ...req.headers }` — copies ALL client headers including `connection` 2. `index.js` line 151: `requestHeaders = rewriteRequestHeaders(this.request, headers)` — proxy adds custom headers (e.g., `x-forwarded-by`) 3. `index.js` line 180: `requestImpl({...headers: requestHeaders...})` — passes headers to transport 4. `request.js` line 191 (undici): `getConnectionHeaders(req.headers)` — reads Connection header FROM THE CLIENT 5. `request.js` lines 198-200: Strips headers listed in Connection — including proxy-added headers This is distinct from the general hop-by-hop forwarding concern — it's specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy's `rewriteRequestHeaders` function. ### PoC Self-contained reproduction with an upstream echo service and a proxy that adds a custom header: ```javascript const fastify = require('fastify'); async function test() { // Upstream service that echoes headers const upstream = fastify({ logger: false }); upstream.get('/api/echo-headers', async (request) => { return { headers: request.headers }; }); await upstream.listen({ port: 19801 }); // Proxy that adds a custom header via rewriteRequestHeaders const proxy = fastify({ logger: false }); await proxy.register(require('@fastify/reply-from'), { base: 'http://localhost:19801' }); proxy.get('/proxy/*', async (request, reply) => { const target = '/' + (request.params['*'] || ''); return reply.from(target, { rewriteRequestHeaders: (originalReq, headers) => { return { ...headers, 'x-forwarded-by': 'fastify-proxy' }; } }); }); await proxy.listen({ port: 19800 }); // Baseline: proxy adds x-forwarded-by header const res1 = await proxy.inject({ method: 'GET', url: '/proxy/api/echo-headers' }); console.log('Baseline response headers from upstream:'); const body1 = JSON.parse(res1.body); console.log(' x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT'); // Attack: Connection header strips the proxy-added header const res2 = await proxy.inject({ method: 'GET', url: '/proxy/api/echo-headers', headers: { 'connection': 'x-forwarded-by' } }); console.log('\nAttack response headers from upstream:'); const body2 = JSON.parse(res2.body); console.log(' x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)'); await proxy.close(); await upstream.close(); } test(); ``` Actual output: ``` Baseline response headers from upstream: x-forwarded-by: fastify-proxy Attack response headers from upstream: x-forwarded-by: NOT PRESENT (stripped!) ``` The `x-forwarded-by` header that the proxy explicitly added in `rewriteRequestHeaders` is stripped before reaching the upstream. Multiple headers can be stripped at once by sending `Connection: x-forwarded-by, x-forwarded-for`. Both the undici (default) and HTTP/1.1 transport handlers in `@fastify/reply-from` are affected, as well as `@fastify/http-proxy` which delegates to `@fastify/reply-from`. ### Impact Attackers can selectively remove any header added by the proxy's `rewriteRequestHeaders` function. This enables several attack scenarios: 1. **Bypass proxy identification**: Strip headers that identify requests as coming through the proxy, potentially bypassing upstream controls that differentiate between direct and proxied requests 2. **Circumvent access control**: If the proxy adds headers used for routing, authorization, or security decisions (e.g., `x-internal-auth`, `x-proxy-token`), attackers can strip them to access unauthorized resources 3. **Remove arbitrary headers**: Any header can be targeted, including `Connection: authorization` to strip authentication or `Connection: x-forwarded-for, x-forwarded-by` to remove multiple headers at once This vulnerability affects deployments where the proxy adds security-relevant headers that downstream services rely on for access control decisions. It undermines the security model where proxies act as trusted intermediaries adding authentication or routing signals. ### Affected Versions - `@fastify/reply-from` — All versions, both undici (default) and HTTP/1.1 transport handlers - `@fastify/http-proxy` — All versions (delegates to `@fastify/reply-from`) - Any configuration using `rewriteRequestHeaders` to add headers that could be security-relevant - No special configuration required to exploit — works with default settings ### Suggested Fix The Connection header from the client should be processed and consumed before `rewriteRequestHeaders` is called, not after. Alternatively, the Connection header processing in `request.js` should maintain a list of headers that existed in the original client request and only strip those, not headers added by `rewriteRequestHeaders`.

Source published

16 Apr 2026 01:02:59 UTC

Source modified

10 Sep 2026 03:51:01 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

Publisher rating · CRITICAL