CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-33805

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 4.1%

CVSS Severity

CVSS v3 Score 8.6

References

Products affected by CVE-2026-33805

Fastify » Fastify/http-Proxy » Version: 0.1.1

cpe:2.3:a:fastify:fastify/http-proxy:0.1.1
Fastify » Fastify/http-Proxy » Version: 0.2.0

cpe:2.3:a:fastify:fastify/http-proxy:0.2.0
Fastify » Fastify/http-Proxy » Version: 0.2.1

cpe:2.3:a:fastify:fastify/http-proxy:0.2.1
Fastify » Fastify/http-Proxy » Version: 0.3.0

cpe:2.3:a:fastify:fastify/http-proxy:0.3.0
Fastify » Fastify/http-Proxy » Version: 0.4.0

cpe:2.3:a:fastify:fastify/http-proxy:0.4.0
Fastify » Fastify/http-Proxy » Version: 0.4.1

cpe:2.3:a:fastify:fastify/http-proxy:0.4.1
Fastify » Fastify/http-Proxy » Version: 0.4.2

cpe:2.3:a:fastify:fastify/http-proxy:0.4.2
Fastify » Fastify/http-Proxy » Version: 0.4.3

cpe:2.3:a:fastify:fastify/http-proxy:0.4.3
Fastify » Fastify/http-Proxy » Version: 0.6.0

cpe:2.3:a:fastify:fastify/http-proxy:0.6.0
Fastify » Fastify/http-Proxy » Version: 0.7.0

cpe:2.3:a:fastify:fastify/http-proxy:0.7.0
Fastify » Fastify/http-Proxy » Version: 0.8.0

cpe:2.3:a:fastify:fastify/http-proxy:0.8.0
Fastify » Fastify/http-Proxy » Version: 1.0.0

cpe:2.3:a:fastify:fastify/http-proxy:1.0.0
Fastify » Fastify/http-Proxy » Version: 10.0.0

cpe:2.3:a:fastify:fastify/http-proxy:10.0.0
Fastify » Fastify/http-Proxy » Version: 10.0.1

cpe:2.3:a:fastify:fastify/http-proxy:10.0.1
Fastify » Fastify/http-Proxy » Version: 10.0.2

cpe:2.3:a:fastify:fastify/http-proxy:10.0.2
Fastify » Fastify/http-Proxy » Version: 11.0.0

cpe:2.3:a:fastify:fastify/http-proxy:11.0.0
Fastify » Fastify/http-Proxy » Version: 11.0.1

cpe:2.3:a:fastify:fastify/http-proxy:11.0.1
Fastify » Fastify/http-Proxy » Version: 11.1.0

cpe:2.3:a:fastify:fastify/http-proxy:11.1.0
Fastify » Fastify/http-Proxy » Version: 11.1.1

cpe:2.3:a:fastify:fastify/http-proxy:11.1.1
Fastify » Fastify/http-Proxy » Version: 11.1.2

cpe:2.3:a:fastify:fastify/http-proxy:11.1.2
Fastify » Fastify/http-Proxy » Version: 11.2.0

cpe:2.3:a:fastify:fastify/http-proxy:11.2.0
Fastify » Fastify/http-Proxy » Version: 11.3.0

cpe:2.3:a:fastify:fastify/http-proxy:11.3.0
Fastify » Fastify/http-Proxy » Version: 11.4.0

cpe:2.3:a:fastify:fastify/http-proxy:11.4.0
Fastify » Fastify/http-Proxy » Version: 11.4.1

cpe:2.3:a:fastify:fastify/http-proxy:11.4.1
Fastify » Fastify/http-Proxy » Version: 11.4.2

cpe:2.3:a:fastify:fastify/http-proxy:11.4.2
Fastify » Fastify/http-Proxy » Version: 11.4.3

cpe:2.3:a:fastify:fastify/http-proxy:11.4.3
Fastify » Fastify/http-Proxy » Version: 2.0.1

cpe:2.3:a:fastify:fastify/http-proxy:2.0.1
Fastify » Fastify/http-Proxy » Version: 2.0.2

cpe:2.3:a:fastify:fastify/http-proxy:2.0.2
Fastify » Fastify/http-Proxy » Version: 2.0.3

cpe:2.3:a:fastify:fastify/http-proxy:2.0.3
Fastify » Fastify/http-Proxy » Version: 2.1.0

cpe:2.3:a:fastify:fastify/http-proxy:2.1.0
Fastify » Fastify/http-Proxy » Version: 2.2.0

cpe:2.3:a:fastify:fastify/http-proxy:2.2.0
Fastify » Fastify/http-Proxy » Version: 2.3.0

cpe:2.3:a:fastify:fastify/http-proxy:2.3.0
Fastify » Fastify/http-Proxy » Version: 3.0.0

cpe:2.3:a:fastify:fastify/http-proxy:3.0.0
Fastify » Fastify/http-Proxy » Version: 3.1.0

cpe:2.3:a:fastify:fastify/http-proxy:3.1.0
Fastify » Fastify/http-Proxy » Version: 3.2.0

cpe:2.3:a:fastify:fastify/http-proxy:3.2.0
Fastify » Fastify/http-Proxy » Version: 4.0.0

cpe:2.3:a:fastify:fastify/http-proxy:4.0.0
Fastify » Fastify/http-Proxy » Version: 4.0.1

cpe:2.3:a:fastify:fastify/http-proxy:4.0.1
Fastify » Fastify/http-Proxy » Version: 4.0.2

cpe:2.3:a:fastify:fastify/http-proxy:4.0.2
Fastify » Fastify/http-Proxy » Version: 4.0.3

cpe:2.3:a:fastify:fastify/http-proxy:4.0.3
Fastify » Fastify/http-Proxy » Version: 4.0.4

cpe:2.3:a:fastify:fastify/http-proxy:4.0.4
Fastify » Fastify/http-Proxy » Version: 4.1.0

cpe:2.3:a:fastify:fastify/http-proxy:4.1.0
Fastify » Fastify/http-Proxy » Version: 4.2.0

cpe:2.3:a:fastify:fastify/http-proxy:4.2.0
Fastify » Fastify/http-Proxy » Version: 4.3.0

cpe:2.3:a:fastify:fastify/http-proxy:4.3.0
Fastify » Fastify/http-Proxy » Version: 4.3.1

cpe:2.3:a:fastify:fastify/http-proxy:4.3.1
Fastify » Fastify/http-Proxy » Version: 4.4.0

cpe:2.3:a:fastify:fastify/http-proxy:4.4.0
Fastify » Fastify/http-Proxy » Version: 5.0.0

cpe:2.3:a:fastify:fastify/http-proxy:5.0.0
Fastify » Fastify/http-Proxy » Version: 6.0.0

cpe:2.3:a:fastify:fastify/http-proxy:6.0.0
Fastify » Fastify/http-Proxy » Version: 6.0.1

cpe:2.3:a:fastify:fastify/http-proxy:6.0.1
Fastify » Fastify/http-Proxy » Version: 6.1.0

cpe:2.3:a:fastify:fastify/http-proxy:6.1.0
Fastify » Fastify/http-Proxy » Version: 6.2.0

cpe:2.3:a:fastify:fastify/http-proxy:6.2.0
Fastify » Fastify/http-Proxy » Version: 6.2.1

cpe:2.3:a:fastify:fastify/http-proxy:6.2.1
Fastify » Fastify/http-Proxy » Version: 6.2.2

cpe:2.3:a:fastify:fastify/http-proxy:6.2.2
Fastify » Fastify/http-Proxy » Version: 7.0.0

cpe:2.3:a:fastify:fastify/http-proxy:7.0.0
Fastify » Fastify/http-Proxy » Version: 7.1.0

cpe:2.3:a:fastify:fastify/http-proxy:7.1.0
Fastify » Fastify/http-Proxy » Version: 7.2.0

cpe:2.3:a:fastify:fastify/http-proxy:7.2.0
Fastify » Fastify/http-Proxy » Version: 8.0.0

cpe:2.3:a:fastify:fastify/http-proxy:8.0.0
Fastify » Fastify/http-Proxy » Version: 8.0.1

cpe:2.3:a:fastify:fastify/http-proxy:8.0.1
Fastify » Fastify/http-Proxy » Version: 8.0.2

cpe:2.3:a:fastify:fastify/http-proxy:8.0.2
Fastify » Fastify/http-Proxy » Version: 8.1.0

cpe:2.3:a:fastify:fastify/http-proxy:8.1.0
Fastify » Fastify/http-Proxy » Version: 8.2.0

cpe:2.3:a:fastify:fastify/http-proxy:8.2.0
Fastify » Fastify/http-Proxy » Version: 8.2.1

cpe:2.3:a:fastify:fastify/http-proxy:8.2.1
Fastify » Fastify/http-Proxy » Version: 8.2.2

cpe:2.3:a:fastify:fastify/http-proxy:8.2.2
Fastify » Fastify/http-Proxy » Version: 8.2.3

cpe:2.3:a:fastify:fastify/http-proxy:8.2.3
Fastify » Fastify/http-Proxy » Version: 8.3.0

cpe:2.3:a:fastify:fastify/http-proxy:8.3.0
Fastify » Fastify/http-Proxy » Version: 8.4.0

cpe:2.3:a:fastify:fastify/http-proxy:8.4.0
Fastify » Fastify/http-Proxy » Version: 9.0.0

cpe:2.3:a:fastify:fastify/http-proxy:9.0.0
Fastify » Fastify/http-Proxy » Version: 9.1.0

cpe:2.3:a:fastify:fastify/http-proxy:9.1.0
Fastify » Fastify/http-Proxy » Version: 9.2.0

cpe:2.3:a:fastify:fastify/http-proxy:9.2.0
Fastify » Fastify/http-Proxy » Version: 9.2.1

cpe:2.3:a:fastify:fastify/http-proxy:9.2.1
Fastify » Fastify/http-Proxy » Version: 9.3.0

cpe:2.3:a:fastify:fastify/http-proxy:9.3.0
Fastify » Fastify/http-Proxy » Version: 9.4.0

cpe:2.3:a:fastify:fastify/http-proxy:9.4.0
Fastify » Fastify/http-Proxy » Version: 9.5.0

cpe:2.3:a:fastify:fastify/http-proxy:9.5.0
Fastify » Reply-From » Version: N/A

cpe:2.3:a:fastify:reply-from:-
Fastify » Reply-From » Version: 0.1.0

cpe:2.3:a:fastify:reply-from:0.1.0
Fastify » Reply-From » Version: 0.2.0

cpe:2.3:a:fastify:reply-from:0.2.0
Fastify » Reply-From » Version: 0.3.0

cpe:2.3:a:fastify:reply-from:0.3.0
Fastify » Reply-From » Version: 0.4.0

cpe:2.3:a:fastify:reply-from:0.4.0
Fastify » Reply-From » Version: 0.4.1

cpe:2.3:a:fastify:reply-from:0.4.1
Fastify » Reply-From » Version: 0.4.3

cpe:2.3:a:fastify:reply-from:0.4.3
Fastify » Reply-From » Version: 0.4.4

cpe:2.3:a:fastify:reply-from:0.4.4
Fastify » Reply-From » Version: 0.4.5

cpe:2.3:a:fastify:reply-from:0.4.5
Fastify » Reply-From » Version: 0.4.6

cpe:2.3:a:fastify:reply-from:0.4.6
Fastify » Reply-From » Version: 0.5.0

cpe:2.3:a:fastify:reply-from:0.5.0
Fastify » Reply-From » Version: 0.5.2

cpe:2.3:a:fastify:reply-from:0.5.2
Fastify » Reply-From » Version: 0.5.3

cpe:2.3:a:fastify:reply-from:0.5.3
Fastify » Reply-From » Version: 0.5.4

cpe:2.3:a:fastify:reply-from:0.5.4
Fastify » Reply-From » Version: 0.6.0

cpe:2.3:a:fastify:reply-from:0.6.0
Fastify » Reply-From » Version: 0.6.1

cpe:2.3:a:fastify:reply-from:0.6.1
Fastify » Reply-From » Version: 0.6.2

cpe:2.3:a:fastify:reply-from:0.6.2
Fastify » Reply-From » Version: 1.0.0

cpe:2.3:a:fastify:reply-from:1.0.0
Fastify » Reply-From » Version: 1.1.0

cpe:2.3:a:fastify:reply-from:1.1.0
Fastify » Reply-From » Version: 10.0.0

cpe:2.3:a:fastify:reply-from:10.0.0
Fastify » Reply-From » Version: 11.0.0

cpe:2.3:a:fastify:reply-from:11.0.0
Fastify » Reply-From » Version: 11.0.1

cpe:2.3:a:fastify:reply-from:11.0.1
Fastify » Reply-From » Version: 11.0.2

cpe:2.3:a:fastify:reply-from:11.0.2
Fastify » Reply-From » Version: 12.0.0

cpe:2.3:a:fastify:reply-from:12.0.0
Fastify » Reply-From » Version: 12.0.1

cpe:2.3:a:fastify:reply-from:12.0.1
Fastify » Reply-From » Version: 12.0.2

cpe:2.3:a:fastify:reply-from:12.0.2
Fastify » Reply-From » Version: 12.1.0

cpe:2.3:a:fastify:reply-from:12.1.0
Fastify » Reply-From » Version: 12.2.0

cpe:2.3:a:fastify:reply-from:12.2.0
Fastify » Reply-From » Version: 12.3.0

cpe:2.3:a:fastify:reply-from:12.3.0
Fastify » Reply-From » Version: 12.3.1

cpe:2.3:a:fastify:reply-from:12.3.1
Fastify » Reply-From » Version: 12.4.0

cpe:2.3:a:fastify:reply-from:12.4.0
Fastify » Reply-From » Version: 12.5.0

cpe:2.3:a:fastify:reply-from:12.5.0
Fastify » Reply-From » Version: 12.6.1

cpe:2.3:a:fastify:reply-from:12.6.1
Fastify » Reply-From » Version: 2.0.0

cpe:2.3:a:fastify:reply-from:2.0.0
Fastify » Reply-From » Version: 2.0.1

cpe:2.3:a:fastify:reply-from:2.0.1
Fastify » Reply-From » Version: 2.2.0

cpe:2.3:a:fastify:reply-from:2.2.0
Fastify » Reply-From » Version: 3.0.0

cpe:2.3:a:fastify:reply-from:3.0.0
Fastify » Reply-From » Version: 3.1.0

cpe:2.3:a:fastify:reply-from:3.1.0
Fastify » Reply-From » Version: 3.1.1

cpe:2.3:a:fastify:reply-from:3.1.1
Fastify » Reply-From » Version: 3.1.2

cpe:2.3:a:fastify:reply-from:3.1.2
Fastify » Reply-From » Version: 3.1.3

cpe:2.3:a:fastify:reply-from:3.1.3
Fastify » Reply-From » Version: 3.1.4

cpe:2.3:a:fastify:reply-from:3.1.4
Fastify » Reply-From » Version: 3.2.0

cpe:2.3:a:fastify:reply-from:3.2.0
Fastify » Reply-From » Version: 3.3.0

cpe:2.3:a:fastify:reply-from:3.3.0
Fastify » Reply-From » Version: 3.4.0

cpe:2.3:a:fastify:reply-from:3.4.0
Fastify » Reply-From » Version: 3.5.0

cpe:2.3:a:fastify:reply-from:3.5.0
Fastify » Reply-From » Version: 4.0.0

cpe:2.3:a:fastify:reply-from:4.0.0
Fastify » Reply-From » Version: 4.0.2

cpe:2.3:a:fastify:reply-from:4.0.2
Fastify » Reply-From » Version: 4.18.0

cpe:2.3:a:fastify:reply-from:4.18.0
Fastify » Reply-From » Version: 5.0.0

cpe:2.3:a:fastify:reply-from:5.0.0
Fastify » Reply-From » Version: 5.0.1

cpe:2.3:a:fastify:reply-from:5.0.1
Fastify » Reply-From » Version: 5.0.2

cpe:2.3:a:fastify:reply-from:5.0.2
Fastify » Reply-From » Version: 5.1.0

cpe:2.3:a:fastify:reply-from:5.1.0
Fastify » Reply-From » Version: 5.2.0

cpe:2.3:a:fastify:reply-from:5.2.0
Fastify » Reply-From » Version: 5.3.0

cpe:2.3:a:fastify:reply-from:5.3.0
Fastify » Reply-From » Version: 6.0.0

cpe:2.3:a:fastify:reply-from:6.0.0
Fastify » Reply-From » Version: 6.0.1

cpe:2.3:a:fastify:reply-from:6.0.1
Fastify » Reply-From » Version: 6.1.0

cpe:2.3:a:fastify:reply-from:6.1.0
Fastify » Reply-From » Version: 6.2.0

cpe:2.3:a:fastify:reply-from:6.2.0
Fastify » Reply-From » Version: 6.3.0

cpe:2.3:a:fastify:reply-from:6.3.0
Fastify » Reply-From » Version: 6.4.0

cpe:2.3:a:fastify:reply-from:6.4.0
Fastify » Reply-From » Version: 6.4.1

cpe:2.3:a:fastify:reply-from:6.4.1
Fastify » Reply-From » Version: 6.4.2

cpe:2.3:a:fastify:reply-from:6.4.2
Fastify » Reply-From » Version: 6.4.3

cpe:2.3:a:fastify:reply-from:6.4.3
Fastify » Reply-From » Version: 6.5.0

cpe:2.3:a:fastify:reply-from:6.5.0
Fastify » Reply-From » Version: 6.6.0

cpe:2.3:a:fastify:reply-from:6.6.0
Fastify » Reply-From » Version: 7.0.0

cpe:2.3:a:fastify:reply-from:7.0.0
Fastify » Reply-From » Version: 7.0.1

cpe:2.3:a:fastify:reply-from:7.0.1
Fastify » Reply-From » Version: 8.0.0

cpe:2.3:a:fastify:reply-from:8.0.0
Fastify » Reply-From » Version: 8.1.0

cpe:2.3:a:fastify:reply-from:8.1.0
Fastify » Reply-From » Version: 8.2.0

cpe:2.3:a:fastify:reply-from:8.2.0
Fastify » Reply-From » Version: 8.2.1

cpe:2.3:a:fastify:reply-from:8.2.1
Fastify » Reply-From » Version: 8.3.0

cpe:2.3:a:fastify:reply-from:8.3.0
Fastify » Reply-From » Version: 8.3.1

cpe:2.3:a:fastify:reply-from:8.3.1
Fastify » Reply-From » Version: 8.4.0

cpe:2.3:a:fastify:reply-from:8.4.0
Fastify » Reply-From » Version: 8.4.1

cpe:2.3:a:fastify:reply-from:8.4.1
Fastify » Reply-From » Version: 8.4.2

cpe:2.3:a:fastify:reply-from:8.4.2
Fastify » Reply-From » Version: 8.4.3

cpe:2.3:a:fastify:reply-from:8.4.3
Fastify » Reply-From » Version: 9.0.0

cpe:2.3:a:fastify:reply-from:9.0.0
Fastify » Reply-From » Version: 9.0.1

cpe:2.3:a:fastify:reply-from:9.0.1
Fastify » Reply-From » Version: 9.0.2

cpe:2.3:a:fastify:reply-from:9.0.2
Fastify » Reply-From » Version: 9.1.0

cpe:2.3:a:fastify:reply-from:9.1.0
Fastify » Reply-From » Version: 9.2.0

cpe:2.3:a:fastify:reply-from:9.2.0
Fastify » Reply-From » Version: 9.3.0

cpe:2.3:a:fastify:reply-from:9.3.0
Fastify » Reply-From » Version: 9.4.0

cpe:2.3:a:fastify:reply-from:9.4.0
Fastify » Reply-From » Version: 9.5.0

cpe:2.3:a:fastify:reply-from:9.5.0
Fastify » Reply-From » Version: 9.6.0

cpe:2.3:a:fastify:reply-from:9.6.0
Fastify » Reply-From » Version: 9.7.0

cpe:2.3:a:fastify:reply-from:9.7.0
Fastify » Reply-From » Version: 9.8.0

cpe:2.3:a:fastify:reply-from:9.8.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-33805

Products

Pricing

Contact Us