CVE-2025-66415: fastify-reply-from affected by bypass of reply forwarding

December 2, 2025

By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.

References

github.com/advisories/GHSA-2q7r-29rg-6m5h
github.com/fastify/fastify-reply-from
github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66
github.com/fastify/fastify-reply-from/security/advisories/GHSA-2q7r-29rg-6m5h
nvd.nist.gov/vuln/detail/CVE-2025-66415

Code Behaviors & Features

Detect and mitigate CVE-2025-66415 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →