GitHub Advisoryadvisory · npm

GHSA-2q7r-29rg-6m5h fastify-reply-from affected by bypass of reply forwarding

MEDIUM Published 2025-12-02 Modified 2025-12-02 Official page ↗
Aliases
CVE-2025-66415
Ecosystem
npm
Packages
@fastify/reply-from
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-441
Reviewed
2025-12-02

Affected packages

• npm @fastify/reply-from: < 12.5.0 → fixed in 12.5.0

Description

Summary By crafting a malicious URL, an attacker could access routes that are not allowed, even though the `reply.from` is defined for specific routes in `@fastify/reply-from`. Details An attacker can bypass the route defined by the `@fastify/reply-from` package by adding a `..` symbol, which, for `curl` version `8.7.1`, is `%2e%2e`. Impact Everyone is using this package with the routes option to protect a 3rd-party resource.

Related

Alias · CVE (1)

  • CVE-2025-66415 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. vulnerability

Weakness · CWE (1)

  • CWE-441 Unintended Proxy or Intermediary weakness

References