CVE-2026-16158

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions 8.3.1 through 12.6.3

Description Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identical keys despite resolving to different upstream URLs. Consequently, when getUpstream() selects an upstream from request data, a cached URL for one upstream may be reused for a request intended for another, leading to cross-upstream data access and modification. Real-world incidents of elevated activity targeting this issue have been observed.

Recommendations Upgrade to @fastify/reply-from version 12.6.4. As a temporary workaround, pass disableCache: true when registering the plugin.