CVE-2026-33805

Katalog CVE

CVSS 8.6 · High EPSS 0,56%

Kerentanan Improper Neutralization of HTTP Headers for Scripting Syntax pada fastify/http-proxy, fastify reply-from. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cna.openjsf.org/security-advisories.html advisory vendor
• https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37 exploit · mitigasi · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:10175
• https://access.redhat.com/security/cve/CVE-2026-33805
• https://bugzilla.redhat.com/show_bug.cgi?id=2458651
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json