CVE-2026-33805

The record

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Affected packages

Related vulnerabilities

• GHSA-gwhp-pf74-vj37 Fastify's connection header abuse enables stripping of proxy-added headers Same vulnerability
• GHSA-2q7r-29rg-6m5h fastify-reply-from affected by bypass of reply forwarding Also affects @fastify/reply-from
• CVE-2025-66415 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another… Also affects @fastify/reply-from
• CVE-2026-67179 Genkit does not properly validate host request headers. CWE-644
• CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding… CWE-644
• CVE-2026-72574 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an… CWE-644
• CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS… CWE-644
• CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. CWE-644