CVE-2026-117518

{
  "etk_id": "ETK-2026-3277",
  "cve_id": "CVE-2026-117518",
  "display_id": "CVE-2026-117518",
  "ghsa_id": "GHSA-vp2r-3vgv-32g9",
  "euvd_id": "EUVD-2026-115127",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in @fastify/reply-from",
  "summary": "@fastify/reply-from through 12.8.0 can incorrectly validate request paths before forwarding them upstream. An unauthenticated requester may reach upstream endpoints outside the intended proxy prefix when the application relies on that prefix restriction or pre-forwarding route guards.",
  "mitigation": "Upgrade @fastify/reply-from to version 12.8.1 or later. Apply the update wherever proxy path restrictions or forwarding guards are relied upon.",
  "vendor": "@fastify/reply-from",
  "product": "@fastify/reply-from",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 12.8.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "12.8.1"
      ],
      "package_name": "@fastify/reply-from",
      "purl": "pkg:npm/@fastify/reply-from"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.97281055,
  "t0_at": "2026-11-02T10:39:22.468000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T10:39:22.468000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T10:39:22.468000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117518"
    }
  }
}