External risk intelligence

@fastify/reply-from Cross-Upstream Data Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-16158

This is a vulnerability in a Fastify plugin designed to handle HTTP proxying and request forwarding. Such components are typically deployed as part of public-facing web applications, API gateways, or edge services to route or forward traffic, making the vulnerable code path commonly reachable from the internet in standard application deployments.

Fastify\/reply From

8.3.1 to before 12.6.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the `@fastify/reply-from` component, which handles forwarding requests between services. This issue could potentially allow an attacker to gain unauthorized access to and modify data across different internal services by tricking the system into reusing cached information.

It allows data misuse between services.
Remember for potential cross-service data compromise.
Confirm relevance and assess exposure level.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a web application that uses a vulnerable version of the `@fastify/reply-from` plugin. Because the plugin incorrectly builds its internal URL cache key, the attacker can cause the application to reuse a cached URL for a different upstream, potentially leading to unauthorized access or modification of data from unintended sources.

Requires network access and no special privileges.
Triggered by sending specific requests to the application.
Allows cross-upstream data access and modification.

Live Threat

Current exploitation, exposure, and threat context

When configured with its default settings, this vulnerability could allow an attacker to gain access to and potentially modify data that should only be available to other internal services. This occurs because a shared cache key can be reused across different upstream requests, leading to unintended data handling.

Internal service data.
Cache key collision.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and application owners responsible for Fastify-based services must triage this vulnerability by identifying all instances of the affected plugin, assessing their exposure and business criticality, and confirming the accountable owner. Once confirmed, remediation can be planned, prioritizing instances that are externally accessible or handle sensitive data.

Application owners and platform teams.
Verify external accessibility and data exposure.
Plan and coordinate controlled upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @fastify/reply-from?

This software is a plugin for the Fastify web framework designed to handle HTTP request forwarding. Developers use it to build proxies, API gateways, or edge services that route incoming traffic to various backend services. It streamlines communication by managing how requests are passed from the client to the correct upstream destination.

How does CVE-2026-16158 cause data leakage?

The vulnerability stems from CWE-441, or Unintended Proxy or Intermediary. The plugin creates a cache key by simply joining a source path and destination without a separator. This allows different request pairs to result in an identical cache key, tricking the plugin into serving data from the wrong upstream server. Consequently, a request intended for one service might inadvertently access or modify data meant for another.

Do I need to authenticate to trigger this bug?

No. The vulnerability is triggered by sending specially crafted network requests to the application. Authentication is not a prerequisite for exploitation. Note that if you have explicitly configured the plugin to disable its internal cache by setting the disableCache option to true, the flawed key generation logic is bypassed, preventing this specific trigger path.

Is this CVE relevant to my internal services?

Halo Surface Signal indicates that because this plugin is frequently used for public-facing API gateways or edge services, the vulnerable path is often reachable from the internet. While your internal-only services might have lower external exposure, they remain vulnerable if they utilize the default caching configuration, potentially allowing cross-service data access if an attacker gains any network reachability.

How do I secure my application against this vulnerability?

The primary resolution is to upgrade your @fastify/reply-from dependency to version 12.6.4 or later, which contains the fix for the cache key construction. If an immediate upgrade is not feasible, you can apply a temporary workaround by setting the disableCache configuration option to true when registering the plugin in your application code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.