Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107318— @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

Quick assessment

Affected
@fastify/reply-from @fastify/reply-from
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

@fastify/reply-from 是一个 Fastify 插件，用于将请求转发到上游的 HTTP 或 HTTPS 服务器。在 12.7.0 版本之前，所有内置的 HTTPS 传输层都会覆盖安全默认值，将 设置为 ，导致即使应用程序在默认配置中将代理指向 HTTPS 上游服务器，代理也不会验证上游服务器的 TLS 证书。因此，中间人网络攻击者可以冒充配置的 HTTPS 上游服务器，读取代理转发的凭据和请求体，并返回伪造但被应用程序信任的响应。该问题已在 @fastify/reply-from 12.7.0 版本

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107318

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/reply-from @fastify/reply-from 0 ~ 12.7.0 -

II. Public POCs for CVE-2026-107318

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107318

请登录查看更多情报信息。

Other References for CVE-2026-107318 (1)

IV. Related Vulnerabilities

Same product: @fastify/reply-from
Same vendor: @fastify/reply-from
Same weakness: CWE-295

V. Comments for CVE-2026-107318

No comments yet

Leave a comment