@fastify/reply-from Cross-Upstream Request Routing Vulnerability via URL Cache Key Collision

A vulnerability in @fastify/reply-from versions 8.3.1 prior to 12.6.4 allows for cross-upstream request routing due to a URL cache key collision. The vulnerability arises because the internal URL cache key is created by concatenating the destination and source paths without a delimiter. This can lead to different destination-source pairs producing the same cache key while pointing to different upstream URLs. As a result, a cached URL intended for one upstream can be incorrectly reused for a request meant for another, causing unauthorized access to and modification of data across upstreams. The default configuration is vulnerable, but setting disableCache to true can prevent this issue.

Impact

Exploitation of this vulnerability can result in unauthorized cross-upstream data access and modification.

Remediation

Users can upgrade to @fastify/reply-from version 12.6.4 or later. Alternatively, set disableCache to true when registering the plugin to disable the URL cache, although this may incur a performance cost.