CVE-2026-117518

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 12.8.1

Description This plugin forwards requests to an upstream HTTP server. It fails to properly validate proxy paths because it only checks for forward-slash dot-segments. The WHATWG URL parser normalizes backslashes and their percent-encoded forms into forward slashes for http, https, ws, and wss schemes. Consequently, a path using backslash dot-segments can bypass traversal checks, allowing unauthenticated requests to escape intended prefixes and access unintended upstream endpoints. This results in a confidentiality impact and limited integrity impact.

Recommendations Update @fastify/reply-from to version 12.8.1 or later.