What is CVE-2026-117518 in the Fastify reply-from plugin?

CVE-2026-117518 is a high-severity security vulnerability affecting the @fastify/reply-from plugin for Fastify, which is responsible for forwarding requests to an upstream HTTP server revisando las escaladas previas descubiertas en ecosistemas similares. En versiones hasta la 12.8.0 inclusive, el componente presentaba un fallo de validación de rutas que permitía eludir las comprobaciones de salto de directorio.

El problema técnico surge porque el plugin validaba las rutas del proxy únicamente contra segmentos de puntos con barras diagonales normales (forward-slash). Posteriormente, construía la URL de destino utilizando el analizador WHATWG URL, el cual normaliza la barra invertida y su forma codificada en porcentaje a una barra diagonal en los esquemas http, https, ws y wss.

Who is affected by this path traversal flaw?

The vulnerability affects any application using @fastify/reply-from versions up to and including 12.8.0 that relies on scoping proxy requests to a specific upstream prefix or implements route guards in front of the forwarding call. Attackers can leverage this to send unauthenticated requests that escape the intended boundary.

By employing backslash dot-segments, a crafted request bypasses traversal checks and resolves to a different upstream path como ocurre en fallos de Rust, lo que genera un impacto principal sobre la confidencialidad de los recursos de la API o servidor secundario.

How do I protect my application and mitigate the issue?

The maintainers have addressed this issue in version 12.8.1 by updating how paths are handled before URL construction. There are no workarounds available besides upgrading the package.

You can secure your application and mitigate the vulnerability by following these specific instructions:

  1. Verify your project dependencies to check if @fastify/reply-from is installed in a version <= 12.8.0.
  2. Run the package manager update command to fetch the patched release 12.8.1 or higher.
  3. Test your proxy routes to ensure backslash characters and dot-segments are properly rejected before reaching upstream services.