Is CVE-2026-16158 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16158 being exploited in the wild.

How severe is CVE-2026-16158?

High severity, with a CVSS score of 8.7, published 18 July 2026.

Which products and versions are affected?

Fastify Reply-From >= 8.3.1, < 12.6.4.

Is there a fix for CVE-2026-16158?

A patch was published on 2026-07-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16158 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16158?

Check whether you run Fastify Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16158: Fastify @fastify/reply-from cross-upstream request routing via cache collision

Q: Is there a fix for CVE-2026-16158?

A patch was published on 2026-07-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-16158 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-16158?

Check whether you run Fastify Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16158 · Severity: high · CVSS 8.7 · Published 2026-07-18

A vulnerability in the @fastify/reply-from library, which is used to forward requests to other servers, could allow an attacker to redirect traffic to the wrong destination. This occurs because the software incorrectly identifies where to send data, potentially leading to unauthorized access or modification of sensitive information across different backend systems. Organizations using this plugin to route traffic between security-separated environments are at the highest risk.

Technologies: Fastify Reply-From. Vendors: Fastify.

Quick answers

Is CVE-2026-16158 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16158 being exploited in the wild.
How severe is CVE-2026-16158?: High severity, with a CVSS score of 8.7, published 18 July 2026.
Which products and versions are affected?: Fastify Reply-From >= 8.3.1, < 12.6.4.
Is there a fix for CVE-2026-16158?: A patch was published on 2026-07-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16158 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16158?: Check whether you run Fastify Reply-From at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The @fastify/reply-from library (versions 8.3.1 to 12.6.3) builds its internal URL cache key by concatenating the destination and source path without a delimiter. This flaw allows different destination/source pairs to generate identical cache keys (e.g., 'http://127.0.0.1:3100' + '1/private' vs 'http://127.0.0.1:31001' + '/private'). When the 'getUpstream' option is used to route requests, a cached URL for one upstream can be incorrectly reused for another. An attacker who can influence the source path or upstream selection can trigger this collision to access or modify data on an unintended backend. The issue is fixed in version 12.6.4; a workaround is to set 'disableCache: true' during plugin registration.

Affected products

Fastify @fastify/reply-from >= 8.3.1, < 12.6.4

Timeline

2026-07-18: disclosed
2026-07-18: advisory
2026-07-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.