CVE-2026-107318: @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-295

Description

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.

Affected products

@fastify/reply-from: before 12.7.0 — fixed in 12.7.0

How to fix

Upgrade to a fixed version: @fastify/reply-from 12.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-107318 or the next vulnerability affects your stack