# CVE-2026-33805: Fastify proxy components header stripping via Connection header abuse

Source: https://junglewise.ai/threats/cve-2026-33805-fastify-proxy-components-header-stripping-via-connection-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-33805 · Severity: high · CVSS 8.6 · Published 2026-04-15

A vulnerability in Fastify's proxy plugins allows attackers to strip away security and identification headers that the proxy is supposed to add to outgoing requests. This means an attacker could bypass access controls or hide their identity from internal services by tricking the proxy into deleting its own security tags. This could lead to unauthorized access to internal resources that rely on the proxy for authentication or routing decisions.

Technologies: [Fastify Http-Proxy](https://junglewise.ai/threats/technologies/http-proxy), [Fastify Reply-From](https://junglewise.ai/threats/technologies/reply-from), [@fastify/reply-from (npm)](https://junglewise.ai/threats/technologies/fastify-reply-from). Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33805 being exploited in the wild.

**How severe is CVE-2026-33805?** High severity, with a CVSS score of 8.6, published 15 April 2026.

**Which products and versions are affected?** Fastify Http-Proxy <= 11.4.3; Fastify Reply-From <= 12.6.1; @fastify/http-proxy (npm) <= 11.4.3, SEMVER:introduced=0,fixed=11.4.4; @fastify/reply-from (npm) <= 12.6.1, SEMVER:introduced=0,fixed=12.6.2.

**Is there a fix for CVE-2026-33805?** Yes. @fastify/http-proxy (npm): upgrade to 11.4.4 or later; @fastify/reply-from (npm): upgrade to 12.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33805 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33805?** Check whether you run Fastify Http-Proxy, Fastify Reply-From, @fastify/http-proxy (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @fastify/http-proxy (npm): upgrade to 11.4.4 or later

  ```sh
  npm install @fastify/http-proxy@11.4.4
  ```

- @fastify/reply-from (npm): upgrade to 12.6.2 or later

  ```sh
  npm install @fastify/reply-from@12.6.2
  ```


## Technical details

The vulnerability exists in @fastify/reply-from and @fastify/http-proxy due to the incorrect order of header processing. When a proxy uses rewriteRequestHeaders to inject custom headers (e.g., x-forwarded-for or auth tokens), the transport handlers (undici and HTTP/1.1) subsequently read the client-supplied Connection header and strip any headers listed within it. Because this stripping occurs after the proxy has modified the header set, a remote attacker can include proxy-added headers in the Connection value to remove them before the request reaches the upstream service. This subverts security models where upstream services rely on proxy-injected headers for authorization or routing. Patches are available in @fastify/reply-from 12.6.2 and @fastify/http-proxy 11.4.4.

## Affected products

- Fastify @fastify/reply-from <= 12.6.1
- Fastify @fastify/http-proxy <= 11.4.3

## Identifiers

- CVE-2026-33805
- GHSA-gwhp-pf74-vj37

## Timeline

- 2026-04-15: disclosed
- 2026-04-15: patched
- 2026-04-16: advisory

## References

- [https://api.github.com/users/FredKSchott](https://api.github.com/users/FredKSchott)
- [https://github.com/FredKSchott](https://github.com/FredKSchott)
- [https://api.github.com/users/FredKSchott/gists%7B/gist_id%7D](https://api.github.com/users/FredKSchott/gists%7B/gist_id%7D)
- [https://api.github.com/users/FredKSchott/repos](https://api.github.com/users/FredKSchott/repos)
- [https://avatars.githubusercontent.com/u/622227?v=4](https://avatars.githubusercontent.com/u/622227?v=4)
- [https://api.github.com/users/FredKSchott/events%7B/privacy%7D](https://api.github.com/users/FredKSchott/events%7B/privacy%7D)

## Related threats

- [@fastify/http-proxy path traversal via backslash dot-segments](https://junglewise.ai/threats/cve-2026-85124-fastify-http-proxy-path-traversal-via-backslash-dot-segments)
- [Fastify @fastify/http-proxy prefix rewrite bypass via URL-encoded characters](https://junglewise.ai/threats/cve-2026-16117-fastify-fastify-http-proxy-prefix-rewrite-bypass-via-url-encoded)
- [Fastify @fastify/reply-from cross-upstream request routing via cache collision](https://junglewise.ai/threats/cve-2026-16158-fastify-fastify-reply-from-cross-upstream-request-routing-via)
- [Fastify reply-from route bypass using path traversal](https://junglewise.ai/threats/cve-2025-66415-fastify-fastify-reply-from-reply-forwarding-bypass)
- [@fastify/reply-from JSON Content-Type parsing confusion](https://junglewise.ai/threats/cve-2023-51701-fastify-reply-from-json-content-type-parsing-confusion)