GHSA-2q7r-29rg-6m5h
NoneCVSS
—
EPSS
—
Published
Dec 2, 2025
CISA due date
—
The record
fastify-reply-from affected by bypass of reply forwarding
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/reply-from | 0 | 12.5.0 |
Related vulnerabilities
- CVE-2025-66415 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another… Same vulnerability
- GHSA-gwhp-pf74-vj37 Fastify's connection header abuse enables stripping of proxy-added headers Also affects @fastify/reply-from
- CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier… Also affects @fastify/reply-from
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
- CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441