CVE-2025-66415
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Dec 1, 2025
CISA due date
—
The record
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/reply-from | 0 | 12.5.0 |
Related vulnerabilities
- GHSA-2q7r-29rg-6m5h fastify-reply-from affected by bypass of reply forwarding Same vulnerability
- GHSA-gwhp-pf74-vj37 Fastify's connection header abuse enables stripping of proxy-added headers Also affects @fastify/reply-from
- CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier… Also affects @fastify/reply-from
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
- CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441