# @fastify/reply-from (npm) vulnerabilities 3 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 12.8.1 (Nov 2, 2026): no advisory affects it - Newest unaffected release: 12.8.1 (Nov 2, 2026), the latest release - Weekly downloads: 718.9K - Dependents: 355 - Releases: 48 since 7.0.0 (Apr 27, 2022) - Registry: https://www.npmjs.com/package/@fastify/reply-from - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-33805: 7.0.0 to 12.6.1 (12.6.2 is outside it) - CVE-2025-66415: 7.0.0 to 12.4.0 (12.5.0 is outside it) - CVE-2023-51701: 7.0.0 to 9.5.0 (9.6.0 is outside it) ## Advisories (3) ### [CVE-2026-33805](https://cve.now/CVE-2026-33805): @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers - Severity: Critical 9.0 - Published: Apr 15, 2026 - Affected: fixed in 12.6.2. - Fixed in 12.6.2 (released Apr 15, 2026, the day of disclosure). - The latest release, 12.8.1, is not affected. - 22% of @fastify/reply-from downloads last week were affected versions (182.1K). ### [CVE-2025-66415](https://cve.now/CVE-2025-66415): fastify-reply-from bypass of reply forwarding - Severity: Medium 6.9 - Published: Dec 1, 2025 - Affected: fixed in 12.5.0. - Fixed in 12.5.0 (released Dec 1, 2025, the day of disclosure). - The latest release, 12.8.1, is not affected. - 17% of @fastify/reply-from downloads last week were affected versions (145.5K). ### [CVE-2023-51701](https://cve.now/CVE-2023-51701): @fastify-reply-from JSON Content-Type parsing confusion - Severity: Medium 5.3 - Published: Jan 8, 2024 - Affected: fixed in 9.6.0. - Fixed in 9.6.0 (released Jan 8, 2024, the day of disclosure). - The latest release, 12.8.1, is not affected. - 2.6% of @fastify/reply-from downloads last week were affected versions (22.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@fastify/reply-from Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.