Vulnerability Description
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fastify | Fastify\/Http-Proxy | < 11.4.4 |
| Fastify | Reply-From | < 12.6.2 |
Related Weaknesses (CWE)
References
- https://cna.openjsf.org/security-advisories.htmlVendor Advisory
- https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74ExploitMitigationVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/security/cve/CVE-2026-33805
- https://bugzilla.redhat.com/show_bug.cgi?id=2458651
- https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74ExploitMitigationVendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json
FAQ
What is CVE-2026-33805?
CVE-2026-33805 is a vulnerability with a CVSS score of 8.6 (HIGH). @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This all...
How severe is CVE-2026-33805?
CVE-2026-33805 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33805?
Check the references section above for vendor advisories and patch information. Affected products include: Fastify Fastify\/Http-Proxy, Fastify Reply-From.