High 7.4Published Oct 8, 2026

CVE-2026-107318@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects @fastify/reply-from. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.14%, higher than 3% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for @fastify/reply-from

Exploited in the last 30 days

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-295
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.14% (percentile 3)
Assigned by: openjs
NVD analysis: Deferred
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

@fastify/reply-from @fastify/reply-from fastify_reply_from:fastify_reply_from (from the name)	before 12.7.0; 12.7.0 not affected	CNA record

References

https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-j425-jw94-m29r
https://cna.openjsf.org/security-advisories.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.