CVE-2025-66415: fastify-reply-from bypass of reply forwarding
Summary By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.
Details
An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl version 8.7.1, is %2e%2e.
Impact
Everyone is using this package with the routes option to protect a 3rd-party resource.
Other sources
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66415?
CVE-2025-66415 is classified as a high-severity vulnerability due to its potential impact on unauthorized access to server routes.
How do I fix CVE-2025-66415?
To fix CVE-2025-66415, upgrade the fastify-reply-from plugin to version 12.5.0 or later.
What products are affected by CVE-2025-66415?
CVE-2025-66415 affects the fastify-reply-from plugin versions prior to 12.5.0.
What is the potential impact of exploiting CVE-2025-66415?
Exploiting CVE-2025-66415 could allow attackers to access restricted routes which could lead to data leakage or unauthorized actions.
Is there a known workaround for CVE-2025-66415?
There are currently no known workarounds for CVE-2025-66415, and upgrading to the patched version is recommended.