CVE-2026-33805

[CVE catalog]

Severity

Critical · CVSS 9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Apr 15, 2026, 10:13:25 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.44% · Oct 25, 2026

A flaw was found in @fastify/reply-from and @fastify/http-proxy. A remote attacker can exploit this vulnerability by manipulating the Connection header in client requests. This allows the attacker to remove specific headers that the proxy has added for security, routing, or access control purposes. Consequently, an attacker could bypass security mechanisms or gain unauthorized access to resources. @fastify/reply-from: @fastify/http-proxy: Fastify Reply From and HTTP Proxy: Security bypass via Connection header manipulation An Important flaw exists in @fastify/reply-from and @fastify/http-proxy, allowing a remote attacker to bypass security, routing, or access control mechanisms. This is achieved by manipulating the Connection header in client requests, which can remove critical proxy-added headers. If reply-from or http-proxy are being used to add security relevant headers the attacker may be able to remove such information resulting in authentication bypass, privilege escalations or the possibility of jeopardize any further security control which depends on the removed request headers. This vulnerability have a high attack complexity rate as the attacker needs to intercept the communication between the client and the server to be able to manipulate the headers. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.