CVE-2026-117518

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.

• CWE-22

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-vp2r-3vgv-32g9

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-117511A vulnerability has been found in desmondmorris node-tessera…7.3
• CVE-2026-117512A vulnerability was found in oretnom23 php-travel-agency-sys…7.3
• CVE-2026-117513A vulnerability was determined in oretnom23 php-travel-agenc…7.3
• CVE-2026-117514A vulnerability was identified in oretnom23 php-travel-agenc…7.3
• CVE-2026-117515A security flaw has been discovered in oretnom23 php-travel-…7.3
• CVE-2026-117516A weakness has been identified in oretnom23 php-travel-agenc…7.3
• CVE-2026-11752A vulnerability has been identified in armeria-xds versions …5.9
• CVE-2026-117526A vulnerability was found in reduxjs redux-devtools 5.0.0. A…5.3
• CVE-2026-11753A vulnerability has been identified in armeria-saml versions…5.1
• CVE-2026-117530In JetBrains Junie CLI before 26.8.17 command execution was …6.7
• CVE-2026-117531@fastify/multipart is the multipart form-data and file uploa…5.9
• CVE-2026-117532REDAXO core from 5.3.0 before 5.21.4 contains an authenticat…9.8