CyberRota Analysis
AI-GeneratedVersions of @fastify/reply-from from 8.3.1 to 12.6.3 are vulnerable due to improper URL cache key generation, which can lead to cross-upstream data access and modification. This flaw allows cached URLs intended for one upstream to be incorrectly reused for another, posing a significant security risk. Developers and organizations using affected versions should prioritize upgrading to 12.6.4 or implement the workaround by disabling the cache to mitigate potential exploits.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.
Related CVEs
Other vulnerabilities affecting the same vendor(s)