Executive brief
Fastify reply-from is a plugin that forwards HTTP requests to another server and is commonly used to protect third-party resources by restricting which routes can be accessed. An attacker can bypass these route restrictions by crafting malicious URLs containing path traversal sequences (.. or URL-encoded equivalents like %2e%2e), allowing unauthorized access to unprotected resources.
Technical details
This vulnerability is a route access control bypass (CWE-441, Confused Deputy problem) in the @fastify/reply-from package. The vulnerable component is the route matching logic that fails to normalize URLs before checking against defined route restrictions. An unauthenticated attacker on the network can craft requests with path traversal sequences (.. or URL-encoded %2e%2e) to bypass the intended route restrictions, potentially accessing third-party resources that should be protected. No user interaction or authentication is required. The fix, released in version 12.5.0, properly normalizes the request URL by stripping query parameters before route matching, eliminating the bypass vector. All versions through 12.4.0 are affected.
Affected products
- Fastify @fastify/reply-from <= 12.4.0
Timeline
- 2025-12-02: disclosed: Advisory published by GitHub Security
- 2025-12-02: patched: Version 12.5.0 released with fix