Executive brief
A vulnerability in Fastify's proxy plugins allows attackers to strip away security and identification headers that the proxy is supposed to add to outgoing requests. This means an attacker could bypass access controls or hide their identity from internal services by tricking the proxy into deleting its own security tags. This could lead to unauthorized access to internal resources that rely on the proxy for authentication or routing decisions.
Technical details
The vulnerability exists in @fastify/reply-from and @fastify/http-proxy due to the incorrect order of header processing. When a proxy uses rewriteRequestHeaders to inject custom headers (e.g., x-forwarded-for or auth tokens), the transport handlers (undici and HTTP/1.1) subsequently read the client-supplied Connection header and strip any headers listed within it. Because this stripping occurs after the proxy has modified the header set, a remote attacker can include proxy-added headers in the Connection value to remove them before the request reaches the upstream service. This subverts security models where upstream services rely on proxy-injected headers for authorization or routing. Patches are available in @fastify/reply-from 12.6.2 and @fastify/http-proxy 11.4.4.
Affected products
- Fastify @fastify/reply-from <= 12.6.1
- Fastify @fastify/http-proxy <= 11.4.3
Timeline
- 2026-04-15: disclosed
- 2026-04-15: patched
- 2026-04-16: advisory