CVE-2026-117518 Details
Description
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.
A path traversal vulnerability has been identified in the @fastify/reply-from plugin, which is used to forward requests to upstream HTTP servers. This vulnerability exists in versions prior to 12.8.1. The issue arises because the plugin's URL path validation only accounted for forward-slash dot-segments. It then used the WHATWG URL parser, which normalizes backslashes and their percent-encoded equivalents to forward slashes for certain URL schemes. As a result, paths with backslash dot-segments could bypass the intended traversal checks, allowing requests to escape designated prefixes and access unintended upstream endpoints. This flaw primarily impacts confidentiality, with some potential integrity concerns.
Users are advised to upgrade to @fastify/reply-from version 12.8.1 or later. The patched version normalizes backslashes in the URL path and rejects any segments that resolve to dot-segments, control characters, or ambiguous whitespace before constructing the URL.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | AdvisoryBundle |
| https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-vp2r-3vgv-32g9 | openjs | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | openjs |
Affected Products
| Product | Versions |
|---|---|
| Fastify/reply-from | <= 12.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | openjs |