CVE-2025-66415: Bypass of Reply Forwarding in @fastify/reply-from
Summary
CVE-2025-66415: fastify-reply-from affected by bypass of reply forwarding. Affects @fastify/reply-from versions < 12.5.0. Fixed in 12.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @fastify/reply-from package is a Fastify plugin that allows developers to proxy requests to third-party resources. It is designed to enhance the functionality of Fastify applications by enabling seamless integration with external APIs. However, this package has a vulnerability that allows attackers to bypass route protections, potentially exposing sensitive data or resources.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to craft a malicious URL that includes a '..' symbol, which can be encoded as '%2e%2e'. This allows the attacker to bypass the route restrictions set by the @fastify/reply-from package, gaining unauthorized access to routes that should be protected. The impact of this vulnerability is significant for any application using this package with route options to safeguard third-party resources, as it could lead to unauthorized data exposure.
How To Fix
Minimum fixed version
12.5.0
This is the first release that contains the fix.
npm install @fastify/reply-from@12.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on the incoming URLs to prevent the use of '..' sequences. This can be done by checking the request URL and rejecting any requests that contain such patterns.
Conclusion
The CVE-2025-66415 vulnerability in the @fastify/reply-from package poses a significant risk by allowing attackers to bypass route protections. It is crucial for developers using this package to update to the latest version to mitigate this risk. Additionally, implementing workarounds and monitoring for vulnerabilities can further enhance application security.
See every vulnerability recorded for @fastify/reply-from →
FAQ
CVE-2025-66415 is a vulnerability in the @fastify/reply-from package that allows attackers to bypass route protections by crafting malicious URLs.
If your application uses @fastify/reply-from version 12.4.0 or earlier, it is vulnerable. You can check your package-lock.json file or use Vulert to monitor for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive routes and data, potentially compromising the security of your application.
Yes, the vulnerability has been fixed in version 12.5.0 of the @fastify/reply-from package. Updating to this version will resolve the issue.
You can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can also check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/reply-from.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
