🚨High - Two Fastify proxy routing flaws let requests reach unintended upstreams (CVE-2026-16158 & CVE-2026-15631) Two official Fastify (OpenJS) proxy plugins have request-routing vulnerabilities, both CVSS 8.7. CVE-2026-16158 (@fastify/reply-from): the internal URL cache key concatenates destination and source paths with no delimiter, so different pairs can collide. A URL cached for one upstream can be reused for a request meant for another, causing cross-upstream data access and modification. The default config is affected. Fixed in 12.6.4 (workaround: disableCache: true). CVE-2026-15631 (@fastify/http-proxy): WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted WebSocket upgrade with traversal sequences can escape the rewrite prefix and reach upstreams that were never meant to be exposed. A WebSocket variant of CVE-2021-21322. Reachable via non-normalizing clients or forwarding proxies. Fixed in 11.6.0 (no workaround). 👉Upgrade @fastify/reply-from to 12.6.4 and @fastify/http-proxy to 11.6.0.
Post summary
Two CVE-2026-16158 and CVE-2026-15631 vulnerabilities in Fastify proxy plugins are disclosed with detailed exploitation mechanics, high CVSS scores, and patch versions (12.6.4 and 11.6.0) along with a specific workaround for the first.