CVE-2026-33805
8.6 HIGH@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the prox...
Published: 2026-04-15 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 8.6 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CWE
- CWE-644
Affected products
| Vendor | Product |
|---|---|
| fastify | fastify\/http-proxy, reply-from |
Description
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-33805
- [Vendor advisory]https://cna.openjsf.org/security-advisories.html
- [Vendor advisory]https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37
- [Vendor advisory]https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37
Related CVEs
Same vendor
- CVE-2026-7768 — @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy (7.5 HIGH)
- CVE-2026-33808 — Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normaliza... (9.1 CRITICAL)
- CVE-2026-33807 — @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled wh... (9.1 CRITICAL)
Same CWE
- CVE-2026-4096 — IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers (6.5 MEDIUM)
- CVE-2026-48126 — Algernon is a small self-contained pure-Go web server (8.2 HIGH)