CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-02
@fastify/reply-from Path Traversal and Proxy Bypass Vulnerability (CVE-2026-117518)
[Affected Scope] Node.js applications utilizing @fastify/reply-from versions up to and including 12.8.0
[Impact] Unauthenticated attackers can bypass path validation using backslashes (\) or percent-encoded backslashes (%5C) to escape the intended proxy prefix and access unauthorized upstream endpoints
[Mitigation] Immediately upgrade @fastify/reply-from to version 12.8.1 or later, as there are no other official workarounds