CVE-2026-33805
Full vulnerability record from the local CVENow database.
Description
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
Severity
CRITICAL
CVSS score
9.0
(v4.0)
Vulnerability status
Modified
Source identifier
ce714d77-add3-4f53-aff5-83d477b104bb
Published
2026-04-15 11:16:34.990000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-33805",
"sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
"published": "2026-04-15T11:16:34.990",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. \n\nUpgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later."
},
{
"lang": "es",
"value": "@fastify/reply-from v12.6.1 y anteriores y @fastify/http-proxy v11.4.3 y anteriores procesan el encabezado Connection del cliente después de que el proxy ha añadido sus propios encabezados a través de rewriteRequestHeaders. Esto permite a los atacantes eliminar retroactivamente los encabezados añadidos por el proxy de las solicitudes ascendentes al listarlos en el valor del encabezado Connection. Cualquier encabezado añadido por el proxy para fines de enrutamiento, control de acceso o seguridad puede ser eliminado selectivamente por un cliente. @fastify/http-proxy también se ve afectado ya que delega en @fastify/reply-from.\n\nActualice a @fastify/reply-from v12.6.2 o @fastify/http-proxy v11.4.4 o posterior."
}
],
"affected": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"affectedData": [
{
"vendor": "@fastify/reply-from",
"product": "@fastify/reply-from",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/@fastify/reply-from",
"versions": [
{
"version": "0",
"lessThan": "12.6.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.6.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "@fastify/reply-from",
"product": "@fastify/http-proxy",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/@fastify/http-proxy",
"versions": [
{
"version": "0",
"lessThan": "11.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.4.4",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"versions": [
{
"version": "1776795511",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-dashboard-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mod-arch-maas-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T13:08:08.503908Z",
"id": "CVE-2026-33805",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-644"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-444"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fastify:fastify\\/http-proxy:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "11.4.4",
"matchCriteriaId": "E2043F2B-59EB-40CE-9B6D-F8AD357DD033"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fastify:reply-from:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "12.6.2",
"matchCriteriaId": "2EC6D95F-10D0-4E74-AF35-62CF6F597A50"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.openjsf.org/security-advisories.html",
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37",
"source": "ce714d77-add3-4f53-aff5-83d477b104bb",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10175",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33805",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458651",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}