@fastify/reply-from Path Traversal and Proxy Bypass Vulnerability (CVE-2026-117518)
Executive & SecOps Summary
SECOPS ASSESSMENTNode.js applications utilizing @fastify/reply-from versions up to and including 12.8.0
Unauthenticated attackers can bypass path validation using backslashes (\) or percent-encoded backslashes (%5C) to escape the intended proxy prefix and access unauthorized upstream endpoints
Immediately upgrade @fastify/reply-from to version 12.8.1 or later, as there are no other official workarounds
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
There is no workaround other than upgrading the package. Update @fastify/reply-from to version 12.8.1 or later to resolve the issue.
# For npm users
npm install @fastify/reply-from@12.8.1
# For yarn users
yarn add @fastify/reply-from@12.8.1
# For pnpm users
pnpm add @fastify/reply-from@12.8.12. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not possible, you can implement a temporary request-filtering hook in your Fastify application to reject requests containing backslashes or dot-segments before they reach the proxy plugin.
// Temporary request validation hook to block backslashes and traversal attempts
fastify.addHook('onRequest', async (request, reply) => {
const decodedUrl = decodeURIComponent(request.raw.url);
if (decodedUrl.includes('\\') || decodedUrl.includes('..')) {
reply.code(400).send({ error: 'Bad Request', message: 'Suspicious path traversal pattern detected.' });
}
});3. Log Audit & IoC Verification Commands
Verify the installed version of the package and inspect your application logs for potential exploitation attempts containing backslashes or percent-encoded backslashes.
# 1. Check the installed version of @fastify/reply-from
npm list @fastify/reply-from
# 2. Search access logs for backslashes (%5C or \) and path traversal patterns
grep -Ei '(%5C|\\|\.\.)' /var/log/nginx/access.log /var/log/apps/fastify-access.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-117518) is a path traversal and proxy bypass flaw in @fastify/reply-from, a Fastify plugin used to forward HTTP requests to upstream servers.
In affected versions (<= 12.8.0), the plugin validated proxy paths against forward-slash dot-segments (e.g., /../) only. However, when constructing the target URL, it utilized the WHATWG URL parser. The WHATWG URL parser normalizes backslashes (\) and their percent-encoded equivalents (%5C) into forward slashes (/) for http, https, ws, and wss schemes. This parser differential allows path traversal sequences containing backslashes to bypass the initial validation check and resolve to a different upstream path.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by crafting a request containing backslash dot-segments:
- Request Submission: The attacker sends a request to an endpoint, such as
https://example.com/api/v1/proxy/..%5C..%5Cadmin. - Validation Bypass: The
@fastify/reply-fromvalidation logic only checks for forward-slash dot-segments, allowing the backslash-containing path to pass through unchecked. - URL Normalization: The WHATWG URL parser processes the target URL and normalizes
..%5Cto../. - Upstream Forwarding: The request escapes the intended proxy prefix and is forwarded to an unintended upstream endpoint (e.g.,
/admin), bypassing route guards and access controls.
3. Infrastructure & Business Impact
The exploitation of this vulnerability primarily impacts confidentiality, with a limited impact on integrity.
- Exposure of Internal APIs: Attackers can access internal microservices, administrative endpoints, or backend APIs that are not meant to be exposed to the public internet.
- Bypass of Security Controls: Any route guards, authentication middleware, or access control policies configured in front of the forwarding call can be bypassed, allowing unauthorized access to sensitive upstream resources.
Official Vendor Advisories & References
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.
Frequently Asked SecOps Questions (CVE-2026-117518)
FAQQ1. How critical is CVE-2026-117518 and is it actively exploited in the wild?
CVE-2026-117518 is rated CVSS 8.2 (HIGH) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-117518?
Primary impacted vendors include fastify across @fastify/reply-from. Scope summary: All versions of @fastify/reply-from up to and including 12.8.0
Q3. What temporary mitigations or workarounds exist for CVE-2026-117518 before patching?
[Mitigation] Immediately upgrade @fastify/reply-from to version 12.8.1 or later, as there are no other official workarounds Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-117518
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (fastify)
View Category →@fastify/multipart Denial of Service (DoS) Vulnerability via Unpropagated Parser Errors (CVE-2026-117531)
[Affected Scope] Fastify web applications utilizing @fastify/multipart versions 5.3.0 through 10.1.6
@fastify/secure-session Signature Verification Bypass and Session Invalidation Evasion (CVE-2026-117549)
[Affected Scope] Node.js applications using @fastify/secure-session versions 7.5.0 through 8.4.1 configured with the signed cookie option
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384) Security Advisory: Arbitrary File Write via Docker Cache Path
[Affected Scope] JFrog Artifactory Self-Managed instances under specific remote-repository conditions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.