CVE-2025-66415 — fastify-reply-from bypass of reply forwarding
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that …
Published: 2025-12-01 · CVSS: 6.9 · CVSS 4.0
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7