Cyber Resilience

CVE-2025-66415

Fastify Reply-From ≤ 12.4.0

Published
01 December 2025
Modified
06 February 2026
Patch / advisory
View advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-66415 is a medium-severity Confused Deputy (CWE-441) vulnerability in Fastify Reply-From. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes…

more

in @fastify/reply-from. This vulnerability is fixed in 12.5.0.

CWE(s)
CWE-441

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CWE-441 proxy bypass in public-facing Fastify plugin directly enables exploitation of unintended routes via crafted URLs (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-51701Same product: Fastify Reply-From
CVE-2026-33805Same product: Fastify Reply-From
CVE-2026-33807Same vendor: Fastify
CVE-2026-15631Same vendor: Fastify
CVE-2026-16117Same vendor: Fastify
CVE-2026-15074Same vendor: Fastify
CVE-2026-6414Same vendor: Fastify
CVE-2026-33806Same vendor: Fastify
CVE-2026-6270Same vendor: Fastify
CVE-2026-33804Same vendor: Fastify

Affected Assets

fastify
reply-from
≤ 12.4.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V3.5.1
  • V3.5.3
  • V3.5.8

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces route-level access policy so the proxy cannot be tricked into forwarding requests to unauthorized destinations.

AC-4 Information Flow Enforcement good match
prevent

Enforces explicit information-flow rules between the Fastify application and upstream targets, blocking unintended proxying via crafted URLs.

SI-10 Information Input Validation partial match
prevent

Validates the user-supplied URL before forwarding, rejecting values that would cause the confused-deputy behavior described in CWE-441.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 mostly match
prevents

Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.

PR.AA-05 partial match
prevents

Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
prevents

Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.

A.5.16 Identity management partial match
prevents

Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.

A.5.18 Access rights partial match
degrades

Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.

A.8.2 Privileged access rights partial match
degrades

Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.

A.8.20 Networks security partial match
degrades

Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.

A.8.25 Secure development life cycle partial match
prevents

Secure-SDLC practices include design reviews that detect and eliminate confused-deputy proxy patterns before deployment.

References