The error occurs when the internal cache key for @fastify/reply-from is built by concatenating the upstream destination and the source path without a delimiter. This allows different destination/source pairs that resolve to distinct upstream URLs to produce the same cache key. When the plugin selects an upstream based on request data, a cached route for one upstream can be reused for a request that is meant for another upstream, giving the attacker unauthorized read or write access to data belonging to a different upstream context. The vulnerability is a classic case of CWE‑441: Cross‑Context Request Share and can lead to confidentiality compromise and integrity violations.

The affected product is @fastify/reply-from for JavaScript environments. Versions from 8.3.1 up to, but not including, 12.6.4 are vulnerable when the default configuration is used. All builds of the plugin that rely on the automatic URL cache mechanism are at risk unless explicitly configured otherwise.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers who can influence upstream selection or supply crafted requests can cause cross‑upstream data leakage or modification by exploiting the cache key collision. The default configuration amplifies risk, but the issue can be mitigated by disabling the cache or by applying the official patch.