CVE-2026-33805 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

What is CVE-2026-33805?

CVE-2026-33805 is a critical vulnerability in @fastify/reply-from @fastify/http-proxy, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from.

Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Weakness: CWE-444, CWE-644

Which versions are affected by CVE-2026-33805?

4 open source packages ship an affected version, including @fastify/http-proxy and @fastify/reply-from. It affects 2 products.

Products include Fastify Fastify\/Http-Proxy, Fastify Reply-From.

How do I fix CVE-2026-33805?

Upgrade @fastify/http-proxy to 11.4.4 or later.

Is CVE-2026-33805 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33805 exists.

Other vulnerabilities in @fastify/reply-from @fastify/http-proxy

• CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters Critical 10.0
• CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal High 8.7
• CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gwhp-pf74-vj37.