CVE-2025-66415 MEDIUM

CVE-2025-66415: fastify-reply-from bypass of reply forwarding

Vendor Fastify
Product fastify-reply-from
Weakness CWE-441
Published December 1, 2025
Last update December 2, 2025

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 2, 2025 Record updated