@fastify/reply-from is a Fastify plugin that forwards client requests to an upstream HTTP or HTTPS server. Prior to version 12.7.0 every built‑in HTTPS transport ignores the default secure settings and sets rejectUnauthorized to false, so the plugin never verifies the TLS certificate of the upstream server. This flaw is a classic example of CWE-295. An attacker who can position themselves on the network path between the proxy and the upstream server can impersonate the target HTTPS endpoint, capture forwarded credentials and request bodies, and inject forged responses that the application will trust.

The vulnerability affects all installations of @fastify/reply-from with a version older than 12.7.0. Users of 12.7.0 or later are not impacted. The fix is explicitly available in 12.7.0, and earlier versions can be protected by adjusting the rejectUnauthorized setting or by supplying a pre‑configured undici instance or global agent.

The CVSS score of 7.4 indicates a high severity threat. Although the EPSS score is not reported, the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a network‑based man‑in‑the‑middle that can modify traffic between the proxy and the upstream HTTPS server. Successful exploitation would allow an attacker to read and alter sensitive data, compromising confidentiality and integrity for all traffic routed through the proxy.