SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-16158

HIGH · CVSS 8.7 EPSS 0.23% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-18 · Last synced 2026-08-17

CyberRota Analysis

AI-Generated

Versions of @fastify/reply-from from 8.3.1 to 12.6.3 are vulnerable due to improper URL cache key generation, which can lead to cross-upstream data access and modification. This flaw allows cached URLs intended for one upstream to be incorrectly reused for another, posing a significant security risk. Developers and organizations using affected versions should prioritize upgrading to 12.6.4 or implement the workaround by disabling the cache to mitigate potential exploits.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-16158
Severity
HIGH
CVSS
8.7
EPSS
0.23%

Original NVD Description

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.

Related CVEs

Other vulnerabilities affecting the same vendor(s)