CVE-2026-16158 Overview
CVE-2026-16158 is a cache key collision vulnerability in @fastify/reply-from, a Fastify plugin used to forward HTTP requests to upstream services. Affected versions range from 8.3.1 up to but not including 12.6.4. The plugin builds its internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore resolve to the same key while pointing to different upstream URLs. When getUpstream selects an upstream from request data, a cached URL for one upstream can be reused for a request intended for another upstream. This causes cross-upstream data access and modification. The default configuration is affected.
Critical Impact
Cross-upstream data leakage and modification in reverse-proxy deployments using the default cache configuration, weighted by CVSS 8.7 impact on confidentiality and integrity.
Affected Products
- @fastify/reply-from versions 8.3.1 through 12.6.3
- Fastify applications using reply-from with default caching enabled
- Reverse-proxy and API gateway services built on affected plugin versions
Discovery Timeline
- 2026-07-18 - CVE-2026-16158 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16158
Vulnerability Analysis
The vulnerability is classified under [CWE-441] (Unintended Proxy or Intermediary, known as "Confused Deputy"). The plugin caches resolved upstream URLs to reduce parsing overhead on repeated forwarding operations. The cache key is derived by string concatenation of the destination base and the request source path without any separating delimiter.
Because no delimiter exists between the two components, distinct (destination, source) pairs can yield identical cache keys. For example, a destination https://api.example.com/v1 combined with source /users produces the same concatenated key as destination https://api.example.com/v1/us combined with source ers. When getUpstream dynamically selects the destination from request attributes, a subsequent request may retrieve a cached URL bound to a different upstream.
The attack requires timing and knowledge of routing behavior, reflected in the CVSS attack complexity rating. Successful exploitation lets a request reach an upstream it was never authorized for, exposing or modifying data across tenant or service boundaries.
Root Cause
The root cause is unsafe key construction in the internal URL cache. Concatenating two variable-length strings without a boundary marker produces ambiguous keys. Any hash map or lookup structure keyed this way collapses distinct inputs into shared entries.
Attack Vector
An attacker sends crafted requests to a Fastify service that uses reply-from with getUpstream for dynamic routing. By choosing destination and path values that collide with an existing cached key, the attacker steers the proxied request to an unintended upstream. The vector is network-based with no authentication or user interaction required.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-v574-6498-x57v for maintainer technical details.
Detection Methods for CVE-2026-16158
Indicators of Compromise
- Requests in access logs where the resolved upstream host does not match the intended route mapping for the requested path.
- Responses containing data from tenants or services unrelated to the requesting client's context.
- Unexpected 2xx responses for paths that should have been rejected or routed to a different backend.
Detection Strategies
- Inventory Node.js dependencies and flag any @fastify/reply-from version between 8.3.1 and 12.6.3 using npm ls @fastify/reply-from or software composition analysis tooling.
- Instrument the proxy layer to log both the request-derived upstream selection and the actual URL served, then alert on mismatches.
- Correlate cross-tenant data access anomalies with proxy request timing to identify cache-collision exploitation patterns.
Monitoring Recommendations
- Ingest Fastify application and access logs into a centralized analytics platform with schema normalization for HTTP proxy events.
- Alert on statistical deviations in upstream selection distribution per client identifier.
- Retain proxy telemetry long enough to reconstruct request-to-upstream mappings during incident response.
How to Mitigate CVE-2026-16158
Immediate Actions Required
- Upgrade @fastify/reply-from to version 12.6.4 or later across all environments.
- If immediate upgrade is not feasible, register the plugin with disableCache: true to eliminate cache-based collisions.
- Audit recent proxy logs for evidence of cross-upstream routing anomalies during the exposure window.
Patch Information
The maintainers released @fastify/reply-from version 12.6.4 with a corrected cache key construction. Consult the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-v574-6498-x57v for release notes and commit references.
Workarounds
- Pass disableCache: true when registering the plugin to bypass the vulnerable cache path.
- Pin getUpstream outputs to a static allow-list to constrain the destination space and reduce collision surface.
- Segment tenants or services onto separate Fastify instances so that any residual collision cannot cross trust boundaries.
# Configuration example
npm install @fastify/reply-from@12.6.4
# Temporary workaround for older versions:
# fastify.register(replyFrom, { disableCache: true })
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
