CWE-644
AllowedImproper Neutralization of HTTP Headers for Scripting Syntax
Abstraction: Variant · Status: Incomplete
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
116 vulnerabilities reference this CWE, most recent first.
GHSA-9F79-6FPR-26F7
Vulnerability from github – Published: 2026-02-12 06:30 – Updated: 2026-02-12 06:30JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.
{
"affected": [],
"aliases": [
"CVE-2026-26234"
],
"database_specific": {
"cwe_ids": [
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-12T04:15:47Z",
"severity": "HIGH"
},
"details": "JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.",
"id": "GHSA-9f79-6fpr-26f7",
"modified": "2026-02-12T06:30:13Z",
"published": "2026-02-12T06:30:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26234"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jung-smart-visu-server-improper-neutralization-of-http-headers-for-scripting-syntax"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5970.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9HCH-G858-CR9J
Vulnerability from github – Published: 2024-02-02 15:30 – Updated: 2024-02-02 15:30IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270.
{
"affected": [],
"aliases": [
"CVE-2023-47143"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-02T13:15:08Z",
"severity": "CRITICAL"
},
"details": "IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270.",
"id": "GHSA-9hch-g858-cr9j",
"modified": "2024-02-02T15:30:28Z",
"published": "2024-02-02T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47143"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/270270"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7105139"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QXQ-9WPJ-4F86
Vulnerability from github – Published: 2026-07-03 00:31 – Updated: 2026-07-03 00:31The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
{
"affected": [],
"aliases": [
"CVE-2026-54477"
],
"database_specific": {
"cwe_ids": [
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T00:16:52Z",
"severity": "MODERATE"
},
"details": "The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.",
"id": "GHSA-9qxq-9wpj-4f86",
"modified": "2026-07-03T00:31:55Z",
"published": "2026-07-03T00:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54477"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json"
},
{
"type": "WEB",
"url": "https://mygardyn.com/security"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C2M2-2CPV-RG7H
Vulnerability from github – Published: 2026-02-05 00:31 – Updated: 2026-02-05 00:31IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
{
"affected": [],
"aliases": [
"CVE-2024-51451"
],
"database_specific": {
"cwe_ids": [
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-04T22:15:56Z",
"severity": "MODERATE"
},
"details": "IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.",
"id": "GHSA-c2m2-2cpv-rg7h",
"modified": "2026-02-05T00:31:00Z",
"published": "2026-02-05T00:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51451"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7257006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2MP-368Q-JRJG
Vulnerability from github – Published: 2025-10-11 00:30 – Updated: 2025-10-11 00:30The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.
{
"affected": [],
"aliases": [
"CVE-2025-52647"
],
"database_specific": {
"cwe_ids": [
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-10T23:15:36Z",
"severity": "MODERATE"
},
"details": "The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.",
"id": "GHSA-c2mp-368q-jrjg",
"modified": "2025-10-11T00:30:18Z",
"published": "2025-10-11T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52647"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0124562"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F673-96M5-V64F
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.
{
"affected": [],
"aliases": [
"CVE-2017-6031"
],
"database_specific": {
"cwe_ids": [
"CWE-644",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-06T00:29:00Z",
"severity": "HIGH"
},
"details": "A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An \"improper neutralization of HTTP headers for scripting syntax\" issue has been identified, which may allow remote code execution.",
"id": "GHSA-f673-96m5-v64f",
"modified": "2022-05-13T01:36:36Z",
"published": "2022-05-13T01:36:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6031"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-096-01A"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97479"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FFPG-GM3H-4P5P
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2025-11-19 18:59Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "backdrop/backdrop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.32.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-63828"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-644"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-18T21:56:57Z",
"nvd_published_at": "2025-11-18T18:16:13Z",
"severity": "MODERATE"
},
"details": "Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.",
"id": "GHSA-ffpg-gm3h-4p5p",
"modified": "2025-11-19T18:59:46Z",
"published": "2025-11-18T18:32:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63828"
},
{
"type": "PACKAGE",
"url": "https://github.com/backdrop/backdrop"
},
{
"type": "WEB",
"url": "https://github.com/mertdurum06/BackdropCms-1.32.1"
},
{
"type": "WEB",
"url": "https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Backdrop CMS Host Header Injection vulnerability"
}
GHSA-FQVV-MH7W-3JQ3
Vulnerability from github – Published: 2024-12-21 15:30 – Updated: 2025-11-04 00:32IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perform when using Navigator for i.
{
"affected": [],
"aliases": [
"CVE-2024-51464"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-644"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-21T14:15:21Z",
"severity": "MODERATE"
},
"details": "IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perform when using Navigator for i.",
"id": "GHSA-fqvv-mh7w-3jq3",
"modified": "2025-11-04T00:32:15Z",
"published": "2024-12-21T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51464"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7179509"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Dec/19"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Dec/20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GV64-36XP-C47J
Vulnerability from github – Published: 2025-03-25 15:31 – Updated: 2025-03-25 15:31A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
{
"affected": [],
"aliases": [
"CVE-2025-27632"
],
"database_specific": {
"cwe_ids": [
"CWE-644",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T13:15:41Z",
"severity": "MODERATE"
},
"details": "A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.",
"id": "GHSA-gv64-36xp-c47j",
"modified": "2025-03-25T15:31:28Z",
"published": "2025-03-25T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27632"
},
{
"type": "WEB",
"url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GWHP-PF74-VJ37
Vulnerability from github – Published: 2026-04-16 01:02 – Updated: 2026-06-09 10:48Summary
@fastify/reply-from and @fastify/http-proxy process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the Connection header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes.
Details
The vulnerability exists in @fastify/reply-from/lib/request.js at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is:
- Client headers are copied including the
connectionheader (@fastify/reply-from/index.jsline 91) - The proxy adds custom headers via
rewriteRequestHeaders(line 151) - During request construction, the transport handlers read the client's
Connectionheader and strip any headers listed in it - This stripping happens after
rewriteRequestHeaders, allowing clients to target proxy-added headers for removal
RFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client's Connection header after the proxy has already modified the header set.
The call chain:
1. @fastify/reply-from/index.js line 91: headers = { ...req.headers } — copies ALL client headers including connection
2. index.js line 151: requestHeaders = rewriteRequestHeaders(this.request, headers) — proxy adds custom headers (e.g., x-forwarded-by)
3. index.js line 180: requestImpl({...headers: requestHeaders...}) — passes headers to transport
4. request.js line 191 (undici): getConnectionHeaders(req.headers) — reads Connection header FROM THE CLIENT
5. request.js lines 198-200: Strips headers listed in Connection — including proxy-added headers
This is distinct from the general hop-by-hop forwarding concern — it's specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy's rewriteRequestHeaders function.
PoC
Self-contained reproduction with an upstream echo service and a proxy that adds a custom header:
const fastify = require('fastify');
async function test() {
// Upstream service that echoes headers
const upstream = fastify({ logger: false });
upstream.get('/api/echo-headers', async (request) => {
return { headers: request.headers };
});
await upstream.listen({ port: 19801 });
// Proxy that adds a custom header via rewriteRequestHeaders
const proxy = fastify({ logger: false });
await proxy.register(require('@fastify/reply-from'), {
base: 'http://localhost:19801'
});
proxy.get('/proxy/*', async (request, reply) => {
const target = '/' + (request.params['*'] || '');
return reply.from(target, {
rewriteRequestHeaders: (originalReq, headers) => {
return { ...headers, 'x-forwarded-by': 'fastify-proxy' };
}
});
});
await proxy.listen({ port: 19800 });
// Baseline: proxy adds x-forwarded-by header
const res1 = await proxy.inject({
method: 'GET',
url: '/proxy/api/echo-headers'
});
console.log('Baseline response headers from upstream:');
const body1 = JSON.parse(res1.body);
console.log(' x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT');
// Attack: Connection header strips the proxy-added header
const res2 = await proxy.inject({
method: 'GET',
url: '/proxy/api/echo-headers',
headers: { 'connection': 'x-forwarded-by' }
});
console.log('\nAttack response headers from upstream:');
const body2 = JSON.parse(res2.body);
console.log(' x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');
await proxy.close();
await upstream.close();
}
test();
Actual output:
Baseline response headers from upstream:
x-forwarded-by: fastify-proxy
Attack response headers from upstream:
x-forwarded-by: NOT PRESENT (stripped!)
The x-forwarded-by header that the proxy explicitly added in rewriteRequestHeaders is stripped before reaching the upstream.
Multiple headers can be stripped at once by sending Connection: x-forwarded-by, x-forwarded-for.
Both the undici (default) and HTTP/1.1 transport handlers in @fastify/reply-from are affected, as well as @fastify/http-proxy which delegates to @fastify/reply-from.
Impact
Attackers can selectively remove any header added by the proxy's rewriteRequestHeaders function. This enables several attack scenarios:
- Bypass proxy identification: Strip headers that identify requests as coming through the proxy, potentially bypassing upstream controls that differentiate between direct and proxied requests
- Circumvent access control: If the proxy adds headers used for routing, authorization, or security decisions (e.g.,
x-internal-auth,x-proxy-token), attackers can strip them to access unauthorized resources - Remove arbitrary headers: Any header can be targeted, including
Connection: authorizationto strip authentication orConnection: x-forwarded-for, x-forwarded-byto remove multiple headers at once
This vulnerability affects deployments where the proxy adds security-relevant headers that downstream services rely on for access control decisions. It undermines the security model where proxies act as trusted intermediaries adding authentication or routing signals.
Affected Versions
@fastify/reply-from— All versions, both undici (default) and HTTP/1.1 transport handlers@fastify/http-proxy— All versions (delegates to@fastify/reply-from)- Any configuration using
rewriteRequestHeadersto add headers that could be security-relevant - No special configuration required to exploit — works with default settings
Suggested Fix
The Connection header from the client should be processed and consumed before rewriteRequestHeaders is called, not after. Alternatively, the Connection header processing in request.js should maintain a list of headers that existed in the original client request and only strip those, not headers added by rewriteRequestHeaders.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 12.6.1"
},
"package": {
"ecosystem": "npm",
"name": "@fastify/reply-from"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.4.3"
},
"package": {
"ecosystem": "npm",
"name": "@fastify/http-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33805"
],
"database_specific": {
"cwe_ids": [
"CWE-644"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T01:02:59Z",
"nvd_published_at": "2026-04-15T11:16:34Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\n`@fastify/reply-from` and `@fastify/http-proxy` process the client\u0027s `Connection` header after the proxy has added its own headers via `rewriteRequestHeaders`. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the `Connection` header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes.\n\n### Details\n\nThe vulnerability exists in `@fastify/reply-from/lib/request.js` at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is:\n\n1. Client headers are copied including the `connection` header (`@fastify/reply-from/index.js` line 91)\n2. The proxy adds custom headers via `rewriteRequestHeaders` (line 151)\n3. During request construction, the transport handlers read the client\u0027s `Connection` header and strip any headers listed in it\n4. This stripping happens after `rewriteRequestHeaders`, allowing clients to target proxy-added headers for removal\n\nRFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client\u0027s Connection header after the proxy has already modified the header set.\n\nThe call chain:\n1. `@fastify/reply-from/index.js` line 91: `headers = { ...req.headers }` \u2014 copies ALL client headers including `connection`\n2. `index.js` line 151: `requestHeaders = rewriteRequestHeaders(this.request, headers)` \u2014 proxy adds custom headers (e.g., `x-forwarded-by`)\n3. `index.js` line 180: `requestImpl({...headers: requestHeaders...})` \u2014 passes headers to transport\n4. `request.js` line 191 (undici): `getConnectionHeaders(req.headers)` \u2014 reads Connection header FROM THE CLIENT\n5. `request.js` lines 198-200: Strips headers listed in Connection \u2014 including proxy-added headers\n\nThis is distinct from the general hop-by-hop forwarding concern \u2014 it\u0027s specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy\u0027s `rewriteRequestHeaders` function.\n\n### PoC\n\nSelf-contained reproduction with an upstream echo service and a proxy that adds a custom header:\n\n```javascript\nconst fastify = require(\u0027fastify\u0027);\n\nasync function test() {\n // Upstream service that echoes headers\n const upstream = fastify({ logger: false });\n upstream.get(\u0027/api/echo-headers\u0027, async (request) =\u003e {\n return { headers: request.headers };\n });\n await upstream.listen({ port: 19801 });\n\n // Proxy that adds a custom header via rewriteRequestHeaders\n const proxy = fastify({ logger: false });\n await proxy.register(require(\u0027@fastify/reply-from\u0027), {\n base: \u0027http://localhost:19801\u0027\n });\n\n proxy.get(\u0027/proxy/*\u0027, async (request, reply) =\u003e {\n const target = \u0027/\u0027 + (request.params[\u0027*\u0027] || \u0027\u0027);\n return reply.from(target, {\n rewriteRequestHeaders: (originalReq, headers) =\u003e {\n return { ...headers, \u0027x-forwarded-by\u0027: \u0027fastify-proxy\u0027 };\n }\n });\n });\n\n await proxy.listen({ port: 19800 });\n\n // Baseline: proxy adds x-forwarded-by header\n const res1 = await proxy.inject({\n method: \u0027GET\u0027,\n url: \u0027/proxy/api/echo-headers\u0027\n });\n console.log(\u0027Baseline response headers from upstream:\u0027);\n const body1 = JSON.parse(res1.body);\n console.log(\u0027 x-forwarded-by:\u0027, body1.headers[\u0027x-forwarded-by\u0027] || \u0027NOT PRESENT\u0027);\n\n // Attack: Connection header strips the proxy-added header\n const res2 = await proxy.inject({\n method: \u0027GET\u0027,\n url: \u0027/proxy/api/echo-headers\u0027,\n headers: { \u0027connection\u0027: \u0027x-forwarded-by\u0027 }\n });\n console.log(\u0027\\nAttack response headers from upstream:\u0027);\n const body2 = JSON.parse(res2.body);\n console.log(\u0027 x-forwarded-by:\u0027, body2.headers[\u0027x-forwarded-by\u0027] || \u0027NOT PRESENT (stripped!)\u0027);\n\n await proxy.close();\n await upstream.close();\n}\ntest();\n```\n\nActual output:\n```\nBaseline response headers from upstream:\n x-forwarded-by: fastify-proxy\n\nAttack response headers from upstream:\n x-forwarded-by: NOT PRESENT (stripped!)\n```\n\nThe `x-forwarded-by` header that the proxy explicitly added in `rewriteRequestHeaders` is stripped before reaching the upstream.\n\nMultiple headers can be stripped at once by sending `Connection: x-forwarded-by, x-forwarded-for`.\n\nBoth the undici (default) and HTTP/1.1 transport handlers in `@fastify/reply-from` are affected, as well as `@fastify/http-proxy` which delegates to `@fastify/reply-from`.\n\n### Impact\n\nAttackers can selectively remove any header added by the proxy\u0027s `rewriteRequestHeaders` function. This enables several attack scenarios:\n\n1. **Bypass proxy identification**: Strip headers that identify requests as coming through the proxy, potentially bypassing upstream controls that differentiate between direct and proxied requests\n2. **Circumvent access control**: If the proxy adds headers used for routing, authorization, or security decisions (e.g., `x-internal-auth`, `x-proxy-token`), attackers can strip them to access unauthorized resources\n3. **Remove arbitrary headers**: Any header can be targeted, including `Connection: authorization` to strip authentication or `Connection: x-forwarded-for, x-forwarded-by` to remove multiple headers at once\n\nThis vulnerability affects deployments where the proxy adds security-relevant headers that downstream services rely on for access control decisions. It undermines the security model where proxies act as trusted intermediaries adding authentication or routing signals.\n\n### Affected Versions\n\n- `@fastify/reply-from` \u2014 All versions, both undici (default) and HTTP/1.1 transport handlers\n- `@fastify/http-proxy` \u2014 All versions (delegates to `@fastify/reply-from`)\n- Any configuration using `rewriteRequestHeaders` to add headers that could be security-relevant\n- No special configuration required to exploit \u2014 works with default settings\n\n### Suggested Fix\n\nThe Connection header from the client should be processed and consumed before `rewriteRequestHeaders` is called, not after. Alternatively, the Connection header processing in `request.js` should maintain a list of headers that existed in the original client request and only strip those, not headers added by `rewriteRequestHeaders`.",
"id": "GHSA-gwhp-pf74-vj37",
"modified": "2026-06-09T10:48:00Z",
"published": "2026-04-16T01:02:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33805"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/fastify-reply-from"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Fastify\u0027s connection header abuse enables stripping of proxy-added headers"
}
Mitigation
Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
Mitigation
Disable script execution functionality in the clients' browser.
No CAPEC attack patterns related to this CWE.