CVE-2026-33805

OVERVIEW CVE-2026-33805 is a header manipulation vulnerability affecting Fastify proxy modules @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier. The vulnerability allows attackers to exploit improper HTTP Connection header processing to selectively remove security-critical headers that the proxy has added to upstream requests, including those used for routing, access control, and security purposes. SEVERITY The vulnerability has a FAUCET Risk Score of 52.0/100, indicating moderate concern. While CVSS metrics are not available, the attack appears to require client-side manipulation of the Connection header without significant complexity. The potential impact is significant, as attackers can strip proxy-added security headers, potentially bypassing authentication, authorization, or routing controls implemented by administrators. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog, is inactive on threat tracking systems, and has a low EPSS score of 0.00055, suggesting minimal real-world exploitation activity to date. Community attention appears limited. Users should apply patches to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later to remediate the vulnerability proactively.