Executive brief
A vulnerability in the @fastify/reply-from library, which is used to forward requests to other servers, could allow an attacker to redirect traffic to the wrong destination. This occurs because the software incorrectly identifies where to send data, potentially leading to unauthorized access or modification of sensitive information across different backend systems. Organizations using this plugin to route traffic between security-separated environments are at the highest risk.
Technical details
The @fastify/reply-from library (versions 8.3.1 to 12.6.3) builds its internal URL cache key by concatenating the destination and source path without a delimiter. This flaw allows different destination/source pairs to generate identical cache keys (e.g., 'http://127.0.0.1:3100' + '1/private' vs 'http://127.0.0.1:31001' + '/private'). When the 'getUpstream' option is used to route requests, a cached URL for one upstream can be incorrectly reused for another. An attacker who can influence the source path or upstream selection can trigger this collision to access or modify data on an unintended backend. The issue is fixed in version 12.6.4; a workaround is to set 'disableCache: true' during plugin registration.
Affected products
- Fastify @fastify/reply-from >= 8.3.1, < 12.6.4
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory
- 2026-07-18: patched