Is CVE-2026-107318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107318 being exploited in the wild.

How severe is CVE-2026-107318?

High severity, with a CVSS score of 7.4, published 8 October 2026.

Which products and versions are affected?

OpenJS Foundation @Fastify/Reply-From < 12.7.0.

How is CVE-2026-107318 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107318?

Check whether you run OpenJS Foundation @Fastify/Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107318: @fastify/reply-from improper HTTPS certificate validation

Q: Is there a fix for CVE-2026-107318?

Yes: fixed in @fastify/reply-from 12.7.0. Until then: Until upgrading, explicitly set rejectUnauthorized to true on the transport configuration: undici.tls.rejectUnauthorized, http.requestOptions.rejectUnauthorized, or http2.sessionOptions.rejectUnauthorized. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107318 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-107318?

Check whether you run OpenJS Foundation @Fastify/Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107318 · Severity: high · CVSS 7.4 · Published 2026-10-08

@fastify/reply-from is a Fastify plugin that proxies HTTP requests to upstream servers. In versions before 12.7.0, the plugin disables TLS certificate verification by default when forwarding requests to HTTPS upstreams. An attacker on the network path can impersonate the upstream server, intercept credentials and request bodies sent through the proxy, and inject forged responses.

Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-107318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107318 being exploited in the wild.
How severe is CVE-2026-107318?: High severity, with a CVSS score of 7.4, published 8 October 2026.
Which products and versions are affected?: OpenJS Foundation @Fastify/Reply-From < 12.7.0.
Is there a fix for CVE-2026-107318?: Yes: fixed in @fastify/reply-from 12.7.0. Until then: Until upgrading, explicitly set rejectUnauthorized to true on the transport configuration: undici.tls.rejectUnauthorized, http.requestOptions.rejectUnauthorized, or http2.sessionOptions.rejectUnauthorized. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107318 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107318?: Check whether you run OpenJS Foundation @Fastify/Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: @fastify/reply-from 12.7.0

Until upgrading, explicitly set rejectUnauthorized to true on the transport configuration: undici.tls.rejectUnauthorized, http.requestOptions.rejectUnauthorized, or http2.sessionOptions.rejectUnauthorized.

Technical details

The vulnerability stems from built-in HTTPS transports (undici, http, and http2 clients) setting rejectUnauthorized to false by default, disabling upstream certificate verification. An on-path attacker can exploit this by presenting any TLS certificate to impersonate the configured HTTPS upstream. The fix in version 12.7.0 removes the forced insecure default, allowing Node.js and undici to apply standard certificate verification.

Affected products

OpenJS Foundation @fastify/reply-from < 12.7.0

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.