CVE-2026-16158
Description
A flaw was found in @fastify/reply-from. This vulnerability allows a remote attacker to access or modify data intended for a different upstream service. The component incorrectly generates internal cache keys by combining destination and source paths without a proper separator, leading to cache key collisions. This can result in a request for one service inadvertently retrieving or altering data associated with another, causing unauthorized data access or modification.
Statement
Red Hat rates this flaw as having an Important severity impact because unauthenticated remote attackers can breach trust boundaries between separate backend destinations, potentially viewing or modifying sensitive tenant data. In deployments using @fastify/reply-from where upstream targets are dynamically determined per request, the default internal caching mechanism permits overlapping cache identifiers across distinct upstream endpoints. While exploiting the condition requires specific routing configurations, the blast radius extends beyond the proxy itself to downstream systems.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
