high · CVSS v3 8.2

CVE-2026-117518

CVE-2026-117518 affects the @fastify/reply-from plugin, allowing unauthenticated requests to bypass proxy path restrictions via backslash do

Overview

CVE-2026-117518 affects the @fastify/reply-from plugin, allowing unauthenticated requests to bypass proxy path restrictions via backslash dot-segments. This can expose unintended upstream endpoints. The vulnerability is high severity.

Description

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.

Impact

Confidentiality: unauthorized access to upstream resources. Integrity: limited. Availability: none. Impacted parties: developers using the plugin, applications that rely on scoped proxying, and upstream services.

Remediation

Upgrade to @fastify/reply-from 12.8.1 or later. Verify dependency version with npm list @fastify/reply-from, run npm update @fastify/reply-from, and test proxy behavior.

Risk context

High severity, CVSS 8.2. No EPSS data available. Immediate attention recommended to prevent exposure of upstream resources.

Affected products

  • @fastify/reply-from

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.2
CVSS v4
—
EPSS
—

fastify proxy path-traversal backslash confidentiality high-severity nodejs

← All CVEs

Related CVEs

high

CVE-2026-107457

A memory corruption flaw exists in Qt's QMqttClient class when handling certain MQTT 5 connection settings. The bug can corrupt heap memory, leading to application crashes. It affects any application using the Qt MQTT module with MQTT 5 enabled.

View analysis

high

CVE-2026-120347

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

View analysis

high

CVE-2026-120348

A high‑severity code injection flaw exists in the Email Template Rendering component of Dayrui XunRuiCMS up to version 4.7.4. The flaw allows remote attackers to inject arbitrary code via the _get_tpl_content function. It can be exploited without authentication, making it a significant risk for sites running affected versions.

View analysis

high

CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.

View analysis