Most recent entries from all

EUVD-2026-262252

2026-10-07T18:04:31.374552+00:00

EUVD-2026-262252

fkie_cve-2025-66415

2026-10-07T18:04:31.374590+00:00

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.

GHSA-2q7r-29rg-6m5h — fastify-reply-from affected by bypass of reply forwarding

2026-10-07T18:04:31.374624+00:00

Affected: npm: @fastify/reply-from

### Summary By crafting a malicious URL, an attacker could access routes that are not allowed, even though the `reply.from` is defined for specific routes in `@fastify/reply-from`.

### Details

An attacker can bypass the route defined by the `@fastify/reply-from` package by adding a `..` symbol, which, for `curl` version `8.7.1`, is `%2e%2e`.

### Impact

Everyone is using this package with the routes option to protect a 3rd-party resource.