Is CVE-2026-33805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33805 being exploited in the wild.

How severe is CVE-2026-33805?

High severity, with a CVSS score of 8.6, published 15 April 2026.

Which products and versions are affected?

Fastify Http-Proxy <= 11.4.3; Fastify Reply-From <= 12.6.1; @fastify/http-proxy (npm) <= 11.4.3, SEMVER:introduced=0,fixed=11.4.4; @fastify/reply-from (npm) <= 12.6.1, SEMVER:introduced=0,fixed=12.6.2.

Is there a fix for CVE-2026-33805?

Yes. @fastify/http-proxy (npm): upgrade to 11.4.4 or later; @fastify/reply-from (npm): upgrade to 12.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33805 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33805?

Check whether you run Fastify Http-Proxy, Fastify Reply-From, @fastify/http-proxy (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33805: Fastify proxy components header stripping via Connection header abuse

Q: Which products and versions are affected?

Fastify Http-Proxy <= 11.4.3; Fastify Reply-From <= 12.6.1; @fastify/http-proxy (npm) <= 11.4.3, SEMVER:introduced=0,fixed=11.4.4; @fastify/reply-from (npm) <= 12.6.1, SEMVER:introduced=0,fixed=12.6.2.

Q: Is there a fix for CVE-2026-33805?

Yes. @fastify/http-proxy (npm): upgrade to 11.4.4 or later; @fastify/reply-from (npm): upgrade to 12.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33805 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33805?

Check whether you run Fastify Http-Proxy, Fastify Reply-From, @fastify/http-proxy (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33805 · Severity: high · CVSS 8.6 · Published 2026-04-15

A vulnerability in Fastify's proxy plugins allows attackers to strip away security and identification headers that the proxy is supposed to add to outgoing requests. This means an attacker could bypass access controls or hide their identity from internal services by tricking the proxy into deleting its own security tags. This could lead to unauthorized access to internal resources that rely on the proxy for authentication or routing decisions.

Technologies: Fastify Http-Proxy, Fastify Reply-From, @fastify/reply-from (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-33805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33805 being exploited in the wild.
How severe is CVE-2026-33805?: High severity, with a CVSS score of 8.6, published 15 April 2026.
Which products and versions are affected?: Fastify Http-Proxy <= 11.4.3; Fastify Reply-From <= 12.6.1; @fastify/http-proxy (npm) <= 11.4.3, SEMVER:introduced=0,fixed=11.4.4; @fastify/reply-from (npm) <= 12.6.1, SEMVER:introduced=0,fixed=12.6.2.
Is there a fix for CVE-2026-33805?: Yes. @fastify/http-proxy (npm): upgrade to 11.4.4 or later; @fastify/reply-from (npm): upgrade to 12.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33805 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33805?: Check whether you run Fastify Http-Proxy, Fastify Reply-From, @fastify/http-proxy (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@fastify/http-proxy (npm): upgrade to 11.4.4 or later
```
npm install @fastify/http-proxy@11.4.4
```
@fastify/reply-from (npm): upgrade to 12.6.2 or later
```
npm install @fastify/reply-from@12.6.2
```

Technical details

The vulnerability exists in @fastify/reply-from and @fastify/http-proxy due to the incorrect order of header processing. When a proxy uses rewriteRequestHeaders to inject custom headers (e.g., x-forwarded-for or auth tokens), the transport handlers (undici and HTTP/1.1) subsequently read the client-supplied Connection header and strip any headers listed within it. Because this stripping occurs after the proxy has modified the header set, a remote attacker can include proxy-added headers in the Connection value to remove them before the request reaches the upstream service. This subverts security models where upstream services rely on proxy-injected headers for authorization or routing. Patches are available in @fastify/reply-from 12.6.2 and @fastify/http-proxy 11.4.4.

Affected products

Fastify @fastify/reply-from <= 12.6.1
Fastify @fastify/http-proxy <= 11.4.3

Identifiers

CVE-2026-33805
GHSA-gwhp-pf74-vj37

Timeline

2026-04-15: disclosed
2026-04-15: patched
2026-04-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.