CVE-2026-33805

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33805

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33805.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33805

Aliases

GHSA-gwhp-pf74-vj37

Published

2026-04-15T10:13:25.147Z

Modified

2026-07-08T08:13:44.398002992Z

Severity

9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N CVSS Calculator

Summary

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

Details

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33805.json",
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-644"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "11.4.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/fastify/fastify-http-proxy

Affected ranges

Type

GIT

Repo

https://github.com/fastify/fastify-http-proxy

Events

Introduced

Fixed

15df3dc5eca55e2e61dba1745f422690b4a55257

Database specific

{
    "cpe": "cpe:2.3:a:fastify:fastify\\/http-proxy:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.4.4"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/fastify/fastify-reply-from

Events

Introduced

Fixed

457ac75f38bc846e8ab76a7cb1618d6c257b7fa2

Database specific

{
    "cpe": "cpe:2.3:a:fastify:reply-from:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.6.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.2.0

v0.2.1

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.5.0

v0.5.2

v0.5.3

v0.5.4

v0.6.0

v0.6.1

v0.6.2

v0.7.0

v0.8.0

v1.*

v1.0.0

v1.1.0

v10.*

v10.0.0

v10.0.1

v10.0.2

v11.*

v11.0.0

v11.0.1

v11.0.2

v11.1.0

v11.1.1

v11.2.0

v11.3.0

v11.4.0

v11.4.1

v11.4.2

v11.4.3

v12.*

v12.0.0

v12.0.1

v12.0.2

v12.1.0

v12.2.0

v12.3.0

v12.3.1

v12.4.0

v12.5.0

v12.6.1

v2.*

v2.0.0

v2.0.1

v2.0.2

v2.0.3

v2.1.0

v2.2.0

v2.3.0

v3.*

v3.0.0

v3.1.0

v3.1.1

v3.1.2

v3.1.3

v3.1.4

v3.2.0

v3.3.0

v3.4.0

v3.5.0

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.1.0

v4.18.0

v4.2.0

v4.3.0

v4.3.1

v4.4.0

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.1.0

v5.2.0

v5.3.0

v6.*

v6.0.0

v6.0.1

v6.1.0

v6.2.0

v6.2.1

v6.2.2

v6.3.0

v6.4.0

v6.4.1

v6.4.2

v6.4.3

v6.5.0

v6.6.0

v7.*

v7.0.0

v7.0.1

v7.1.0

v8.*

v8.0.0

v8.0.1

v8.0.2

v8.1.0

v8.2.0

v8.2.1

v8.2.2

v8.2.3

v8.3.0

v8.3.1

v8.4.0

v8.4.1

v8.4.2

v8.4.3

v9.*

v9.0.0

v9.0.1

v9.0.2

v9.1.0

v9.2.0

v9.2.1

v9.3.0

v9.4.0

v9.5.0

v9.6.0

v9.7.0

v9.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33805.json"