GHSA-gwhp-pf74-vj37
High · 8.6CVSS
8.6
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
Fastify's connection header abuse enables stripping of proxy-added headers
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/http-proxy | 0 | 11.4.4 |
| npm | @fastify/reply-from | 0 | 12.6.2 |
Related vulnerabilities
- CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier… Same vulnerability
- GHSA-2q7r-29rg-6m5h fastify-reply-from affected by bypass of reply forwarding Also affects @fastify/reply-from
- CVE-2025-66415 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another… Also affects @fastify/reply-from
- CVE-2026-67179 Genkit does not properly validate host request headers. CWE-644
- CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding… CWE-644
- CVE-2026-72574 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an… CWE-644
- CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS… CWE-644
- CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. CWE-644