The vulnerability arises when the plugin processes request paths containing backslash dot-segments. The path is normalized by the URL parser, converting backslashes to forward slashes and thereby bypassing the intended prefix check. As a result, an attacker can craft a request that reaches an upstream endpoint outside the scoped prefix, exposing information that should remain confidential. The flaw does not alter data, so integrity impact is limited.

All installations of the @fastify/reply-from plugin with versions up to and including 12.8.0 are affected. The issue applies to Node.js applications using Fastify that forward requests with this plugin.

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker with network access to the application can exploit the flaw by sending a crafted URL path containing backslash dot-segments. The compromised path will be resolved to an unintended upstream endpoint, granting the attacker access to privileged resources without authentication.