Main Vulnerability Database Vulnerabilities #VU138403

Input validation error in Fastify-http-proxy and Fastify-reply-from - CVE-2026-33805

Published: July 20, 2026

Vulnerability identifier: #VU138403

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2026-33805

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to strip proxy-added headers.

The vulnerability exists due to improper input validation in the connection header handling logic of @fastify/reply-from and @fastify/http-proxy when processing requests containing a crafted Connection header. A remote attacker can send a specially crafted request to strip proxy-added headers.

Affected software

Fastify-http-proxy
Fastify-reply-from

How to mitigate CVE-2026-33805

Install security update from vendor's website.

Fastify-http-proxy - update to 11.4.4
Fastify-reply-from - update to 12.6.4

External References

https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37

Related Security Bulletins