SCA: security update for @fastify/http-proxy, @fastify/reply-from (GHSA-gwhp-pf74-vj37)

critical Tenable Cloud Security Plugin ID 440471

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's
Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows
attackers to retroactively strip proxy-added headers from upstream requests by listing them in the
Connection header value. Any header added by the proxy for routing, access control, or security purposes
can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to
@fastify/reply-from. Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.
(CVE-2026-33805)

Solution

Update the @fastify/http-proxy library and its related packages to version 11.4.4 or later.

Plugin Details

Severity: Critical

ID: 440471

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/16/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.19

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-33805

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9

Threat Score: 7.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/16/2026

Vulnerability Publication Date: 4/15/2026

Reference Information

CVE: CVE-2026-33805

cwe: CWE-644

Detections

Analytics