CVE-2026-117518
Description
A flaw was found in @fastify/reply-from. The plugin only validates forward-slash dot-segments, allowing backslash sequences to bypass traversal checks when the upstream destination URL is constructed. An unauthenticated remote attacker can exploit this vulnerability by submitting requests with crafted path traversal sequences. This flaw allows an attacker to bypass intended proxy prefix restrictions and access unauthorized upstream endpoints, potentially leading to sensitive information disclosure.
Statement
Red Hat has rated this vulnerability as having an Important security impact because an unauthenticated remote attacker can bypass routing restrictions without requiring privileges. In deployments where Fastify applications use the reply-from plugin as an edge gateway or reverse proxy boundary, circumventing path scoping permits requests to escape into unintended backend systems. This unauthorized reach poses a high confidentiality risk across internal networks, while overall integrity impact is limited to the functionality exposed by reachable upstream endpoints.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
