CVE-2026-107318

Status: DeferredHigh (7.4)—

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts.

Read full descriptionShow less

The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base score: 7.4

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.14%
Percentile among all scored CVEs: 3
Score date: 10/14/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1557 Adversary-in-the-Middlecredential access · collection85 %
Primary impactT1005 Data from Local Systemcollection80 %
Secondary impactT1098 Account Manipulationpersistence · privilege escalation75 %
Secondary impactT1565.002 Transmitted Data Manipulationimpact70 %

Atacante en la ruta (AV:N, AC:H) suplanta servidor HTTPS deshabilitando validación TLS (CWE-295). Lee credenciales/cuerpos de solicitud y retorna respuestas falsas que la app confía.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Network Segmentation Encrypt Sensitive Information Disable or Remove Feature or Program User Training User Account Management Restrict File and Directory Permissions

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Fastify — Reply-from^AI

CWEs

CWE-295

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-107318",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107318",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-09T11:50:31.702426Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "affectedData": [
        {
          "vendor": "@fastify/reply-from",
          "product": "@fastify/reply-from",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "12.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "12.7.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/@fastify/reply-from",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-08T21:17:51.807",
  "references": [
    {
      "url": "https://cna.openjsf.org/security-advisories.html",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    },
    {
      "url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-j425-jw94-m29r",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent."
    }
  ],
  "lastModified": "2026-10-09T12:17:08.147",
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"
}