← Vulnerability feed

Vulnerability record · CVE-2026-33805 · published 15 April 2026

CVE-2026-33805: Fastify\/http-proxy http request smuggling vulnerability

Fastify · Fastify\/Http Proxy

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

9.0 CVSS 4.0 Critical EPSS 0.56% · top 55.6% CWE-644 · CWE-644CWE-444 · HTTP request smuggling
9.0CVSS 4.0 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
7References, 2 tagged exploit
15 Jul 2026Last modified by NVD

Description

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37 ExploitMitigationVendor Advisory
https://access.redhat.com/errata/RHSA-2026:10175
https://access.redhat.com/security/cve/CVE-2026-33805
https://bugzilla.redhat.com/show_bug.cgi?id=2458651
https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37 ExploitMitigationVendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json

Track CVE-2026-33805 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-16117Fastify\/http-proxy improper input validation vulnerabilityImpact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's …EPSS 0.44%10.0CVE-2026-15631Fastify\/http-proxy path traversal vulnerabilityImpact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the confi…EPSS 0.50%7.5CVE-2026-85124Fastify\/http-proxy path traversal vulnerability@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the …EPSS 0.74%7.5CVE-2023-51701Fastify reply-from http request smuggling vulnerabilityfastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from`…EPSS 0.48%6.9CVE-2025-66415Fastify reply-from vulnerabilityfastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attack…EPSS 0.18%

Source: NIST National Vulnerability Database (record CVE-2026-33805), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.