CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 13.8%

CVSS Severity

CVSS v3 Score 8.7

References

Products affected by CVE-2026-16158

Fastify » Fastify/reply-From » Version: 10.0.0

cpe:2.3:a:fastify:fastify/reply-from:10.0.0
Fastify » Fastify/reply-From » Version: 11.0.0

cpe:2.3:a:fastify:fastify/reply-from:11.0.0
Fastify » Fastify/reply-From » Version: 11.0.1

cpe:2.3:a:fastify:fastify/reply-from:11.0.1
Fastify » Fastify/reply-From » Version: 11.0.2

cpe:2.3:a:fastify:fastify/reply-from:11.0.2
Fastify » Fastify/reply-From » Version: 12.0.0

cpe:2.3:a:fastify:fastify/reply-from:12.0.0
Fastify » Fastify/reply-From » Version: 12.0.1

cpe:2.3:a:fastify:fastify/reply-from:12.0.1
Fastify » Fastify/reply-From » Version: 12.0.2

cpe:2.3:a:fastify:fastify/reply-from:12.0.2
Fastify » Fastify/reply-From » Version: 12.1.0

cpe:2.3:a:fastify:fastify/reply-from:12.1.0
Fastify » Fastify/reply-From » Version: 12.2.0

cpe:2.3:a:fastify:fastify/reply-from:12.2.0
Fastify » Fastify/reply-From » Version: 12.3.0

cpe:2.3:a:fastify:fastify/reply-from:12.3.0
Fastify » Fastify/reply-From » Version: 12.3.1

cpe:2.3:a:fastify:fastify/reply-from:12.3.1
Fastify » Fastify/reply-From » Version: 12.4.0

cpe:2.3:a:fastify:fastify/reply-from:12.4.0
Fastify » Fastify/reply-From » Version: 12.5.0

cpe:2.3:a:fastify:fastify/reply-from:12.5.0
Fastify » Fastify/reply-From » Version: 12.6.0

cpe:2.3:a:fastify:fastify/reply-from:12.6.0
Fastify » Fastify/reply-From » Version: 12.6.1

cpe:2.3:a:fastify:fastify/reply-from:12.6.1
Fastify » Fastify/reply-From » Version: 12.6.2

cpe:2.3:a:fastify:fastify/reply-from:12.6.2
Fastify » Fastify/reply-From » Version: 12.6.3

cpe:2.3:a:fastify:fastify/reply-from:12.6.3
Fastify » Fastify/reply-From » Version: 8.3.1

cpe:2.3:a:fastify:fastify/reply-from:8.3.1
Fastify » Fastify/reply-From » Version: 8.4.0

cpe:2.3:a:fastify:fastify/reply-from:8.4.0
Fastify » Fastify/reply-From » Version: 8.4.1

cpe:2.3:a:fastify:fastify/reply-from:8.4.1
Fastify » Fastify/reply-From » Version: 8.4.2

cpe:2.3:a:fastify:fastify/reply-from:8.4.2
Fastify » Fastify/reply-From » Version: 8.4.3

cpe:2.3:a:fastify:fastify/reply-from:8.4.3
Fastify » Fastify/reply-From » Version: 9.0.0

cpe:2.3:a:fastify:fastify/reply-from:9.0.0
Fastify » Fastify/reply-From » Version: 9.0.1

cpe:2.3:a:fastify:fastify/reply-from:9.0.1
Fastify » Fastify/reply-From » Version: 9.0.2

cpe:2.3:a:fastify:fastify/reply-from:9.0.2
Fastify » Fastify/reply-From » Version: 9.1.0

cpe:2.3:a:fastify:fastify/reply-from:9.1.0
Fastify » Fastify/reply-From » Version: 9.2.0

cpe:2.3:a:fastify:fastify/reply-from:9.2.0
Fastify » Fastify/reply-From » Version: 9.3.0

cpe:2.3:a:fastify:fastify/reply-from:9.3.0
Fastify » Fastify/reply-From » Version: 9.4.0

cpe:2.3:a:fastify:fastify/reply-from:9.4.0
Fastify » Fastify/reply-From » Version: 9.5.0

cpe:2.3:a:fastify:fastify/reply-from:9.5.0
Fastify » Fastify/reply-From » Version: 9.6.0

cpe:2.3:a:fastify:fastify/reply-from:9.6.0
Fastify » Fastify/reply-From » Version: 9.7.0

cpe:2.3:a:fastify:fastify/reply-from:9.7.0
Fastify » Fastify/reply-From » Version: 9.8.0

cpe:2.3:a:fastify:fastify/reply-from:9.8.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-16158

Products

Pricing

Contact Us