Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-18 | 3 | Disclosure1Patch2 |
| 2026-07-19 | 1 | Active Exploitation1 |
| 2026-08-13 | 1 | General1 |
| 2026-08-14 | 1 | Disclosure1 |
| 2026-08-17 | 1 | Disclosure1 |
🚨 High-severity security fix in @fastify/reply-from@12.6.4 just released! Patches CVE-2026-16158, cross-upstream request routing via URL cache key collision. https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v574-6498-x57v
Post summary
Fastify released a patch for CVE‑2026‑16158, fixing a URL cache key collision that could lead to cross‑upstream request routing.
@fastify/reply-fromに脆弱性、キャッシュ衝突で別の上流サービスへアクセスのおそれ https://www.cybernote.click/2026/08/12/fastify-reply-from-cve-2026-16158-cache-collision/ #IT #Security #cybersecurity
Post summary
The tweet announces a new CVE‑2026‑16158 vulnerability in @fastify/reply-from, describing a cache‑collision issue that could expose upstream services, but it provides no PoC, exploit code, patch, or active exploitation evidence.
@fastify/reply-fromに脆弱性、キャッシュ衝突で別の上流サービスへアクセスのおそれ https://www.cybernote.click/2026/08/12/fastify-reply-from-cve-2026-16158-cache-collision/ #IT #Security #cybersecurity
Post summary
The tweet announces a newly discovered CVE-2026-16158 in fastify/reply-from that could enable upstream service access via a cache collision, with no PoC, exploit, patch, or active exploitation information provided.
@fastify/reply-fromに脆弱性、キャッシュ衝突で別の上流サービスへアクセスのおそれ https://www.cybernote.click/2026/08/12/fastify-reply-from-cve-2026-16158-cache-collision/ #IT #Security #cybersecurity
Post summary
The tweet highlights a cache‑collision vulnerability in @fastify/reply‑from that might permit access to other upstream services, but provides no proof‑of‑concept, exploit code, patch, or evidence of active exploitation.
It is possible to see elevated activities targeting fastify reply-from (CVE-2026-16158) https://vuldb.com/vuln/380052/cti
Post summary
The post reports elevated activity targeting CVE‑2026‑16158 in Fastify, suggesting the vulnerability is being exploited in the wild.
🚨High - Two Fastify proxy routing flaws let requests reach unintended upstreams (CVE-2026-16158 & CVE-2026-15631) Two official Fastify (OpenJS) proxy plugins have request-routing vulnerabilities, both CVSS 8.7. CVE-2026-16158 (@fastify/reply-from): the internal URL cache key concatenates destination and source paths with no delimiter, so different pairs can collide. A URL cached for one upstream can be reused for a request meant for another, causing cross-upstream data access and modification. The default config is affected. Fixed in 12.6.4 (workaround: disableCache: true). CVE-2026-15631 (@fastify/http-proxy): WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted WebSocket upgrade with traversal sequences can escape the rewrite prefix and reach upstreams that were never meant to be exposed. A WebSocket variant of CVE-2021-21322. Reachable via non-normalizing clients or forwarding proxies. Fixed in 11.6.0 (no workaround). 👉Upgrade @fastify/reply-from to 12.6.4 and @fastify/http-proxy to 11.6.0.
Post summary
Two Fastify proxy routing vulnerabilities are disclosed with technical details, and the text provides the necessary patches – upgrade reply‑from to 12.6.4 and http‑proxy to 11.6.0.
CVE-2026-16158 Cache Key Collision in @fastify/reply-from 8.3.1 Through 12.6.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16158
Post summary
The text announces the discovery of CVE‑2026‑16158, a Cache Key Collision vulnerability in @fastify/reply-from, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/reply-from | - | node.js | - |