CVE-2026-33805

HighCVSS 8.6/10Last modified Oct 26, 2026

Description

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-644 CWE-444

Affected software

Vendor	Product	Versions
@fastify/reply-from	@fastify/reply-from	< 12.6.2
@fastify/reply-from	@fastify/http-proxy	< 11.4.4
Red Hat	Red Hat OpenShift Dev Spaces 3.27	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—

References

https://cna.openjsf.org/security-advisories.htmlVendor Advisory
https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37Exploit, Mitigation, Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:10175
https://access.redhat.com/security/cve/CVE-2026-33805
https://bugzilla.redhat.com/show_bug.cgi?id=2458651
https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37Exploit, Mitigation, Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json

Timeline

Published: Apr 15, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-338067.5Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepen CVE-2026-338079.1@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when CVE-2026-338089.1Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalizatio CVE-2026-338095.3A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consump CVE-2026-33819.8Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the z CVE-2026-338108.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs whi CVE-2026-338117.5When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.CVE-2026-338126.1Parsing a malicious font file can cause excessive memory allocation.CVE-2026-338137.5Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.CVE-2026-338147.5When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_F CVE-2026-338159.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.