CVE-2026-107318

Executive Summary

CVE-2026-107318 is a critical improper certificate validation vulnerability (CWE-295) in the @fastify/reply-from plugin for the Fastify Node.js web framework, affecting versions prior to 12.7.0. The flaw causes all built-in HTTPS transports to override the secure default and set rejectUnauthorized to false, meaning the proxy fails to verify the TLS certificate of upstream HTTPS servers even in default configurations. This allows an on-path network attacker to impersonate the configured HTTPS upstream, intercept credentials and request bodies forwarded by the proxy, and return forged responses that the application trusts. With a CVSS score of 7.4, this vulnerability poses a high confidentiality and integrity risk, though no public exploit or PoC is currently available.

Technical Analysis

The @fastify/reply-from plugin is designed to forward requests from a Fastify application to an upstream HTTP or HTTPS server. Under normal secure operation, TLS certificate validation should be enforced when connecting to HTTPS upstreams to prevent man-in-the-middle (MITM) attacks. However, in versions prior to 12.7.0, the plugin's built-in HTTPS transports explicitly set the rejectUnauthorized option to false. In Node.js and the underlying undici HTTP client, rejectUnauthorized: false disables the verification of the server's TLS certificate against trusted certificate authorities.

This misconfiguration occurs by default, meaning that even when an application correctly specifies an https upstream, the proxy will accept any TLS certificate presented by the server—including self-signed, expired, or attacker-controlled certificates. The vulnerability is classified as CWE-295: Improper Certificate Validation, and maps to MITRE ATT&CK T1190 (Exploit Public-Facing Application) as the attack vector is network-adjacent. The CVSS vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates that exploitation requires network access and a high complexity (likely due to the need for an on-path position), but no privileges or user interaction, with a high impact on confidentiality and integrity, and no impact on availability. The root cause lies in the plugin's transport configuration overriding secure defaults, effectively nullifying the protection that TLS should provide.

Exploitation Scenarios

The exploitation of CVE-2026-107318 follows a classic on-path (man-in-the-middle) attack chain, contingent on the attacker achieving a network position between the Fastify application and the upstream HTTPS server. No public PoC exists; the steps below are inferred from the vulnerability class.

1. Reconnaissance/target identification: The attacker identifies a Fastify application that uses @fastify/reply-from to proxy requests to an HTTPS upstream. This can be done by scanning for exposed Fastify instances or by observing network traffic that reveals the plugin's behavior. The attacker must also confirm that the plugin version is prior to 12.7.0, which lacks the fix.

2. Triggering the flaw: The attacker positions themselves on the network path between the Fastify application and the upstream server. This could be achieved through ARP spoofing, DNS spoofing, BGP hijacking, or compromising a network device. When the application initiates an HTTPS request to the upstream via the proxy, the attacker intercepts the TLS handshake. Because the plugin has set rejectUnauthorized to false, the application will not validate the certificate presented by the attacker.

3. Payload/execution method: The attacker presents a forged TLS certificate for the upstream domain and completes the handshake. The attacker can then read the plaintext credentials, request bodies, and any other sensitive data forwarded by the proxy. Additionally, the attacker can return forged responses—such as altered JSON or HTML—that the application will trust and potentially act upon.

4. Post-exploitation impact: With access to credentials and request bodies, the attacker can escalate privileges, access sensitive data, or pivot to other systems. Forged responses could lead to further exploitation, such as injecting malicious content or triggering unauthorized actions. The attack is stealthy because it does not require modifying the application or exploiting a software bug in the traditional sense; it leverages a misconfiguration that silently disables a security control.

Impact Assessment

The business impact of CVE-2026-107318 is significant for organizations relying on Fastify with @fastify/reply-from to proxy sensitive traffic. The CVSS score of 7.4 (High) reflects high confidentiality and integrity impacts, with no availability impact. Affected systems include any Node.js application using the vulnerable plugin version (prior to 12.7.0) to forward requests to HTTPS upstreams. The blast radius depends on the number of such applications and the sensitivity of the data they handle—credentials, API keys, personal data, or financial information. Because the vulnerability is in a widely used open-source package, the potential for widespread exploitation is high if an attacker gains a network foothold. The lack of a public exploit or CISA KEV listing does not diminish the risk, as the attack is straightforward for a skilled adversary with on-path access. The EPSS score is not yet available, but the high CVSS and the nature of the flaw suggest a priority for remediation.

Detection Guidance

Sigma Rule

title: Suspicious Fastify Reply-From TLS Certificate Validation Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential man-in-the-middle exploitation of CVE-2026-107318 in @fastify/reply-from by monitoring for unverified TLS connections to upstream servers.
author: Threat Intelligence Team
date: 2026-07-15
logsource:
  category: network_connection
  product: windows
  service: security
detection:
  selection:
    EventID: 5156
    Direction: 'Outbound'
    DestPort: 443
    Image|endswith: '\node.exe'
  condition: selection
falsepositives:
  - Legitimate node applications making outbound HTTPS connections
level: medium

YARA Rule

rule CVE_2026_107318_Fastify_ReplyFrom_Misconfig
{
    meta:
        description = "Detects @fastify/reply-from versions prior to 12.7.0 that set rejectUnauthorized to false"
        author = "Threat Intelligence Team"
        date = "2026-07-15"
        reference = "CVE-2026-107318"
        hash = "unknown"
    strings:
        $s1 = "rejectUnauthorized" ascii wide nocase
        $s2 = "@fastify/reply-from" ascii wide nocase
        $s3 = "12.7.0" ascii wide nocase
    condition:
        all of them
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-107318 Possible @fastify/reply-from TLS Certificate Validation Bypass"; flow:to_server,established; content:"|16 03|"; depth:2; byte_test:1,>,2,0,relative; byte_test:1,<,4,0,relative; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [network where process.name == "node.exe" and network.direction == "outbound" and destination.port == 443]
  [network where process.name == "node.exe" and network.direction == "outbound" and destination.port == 443 and tls.server.x509.issuer.common_name != "Trusted CA"]

Splunk SPL Query

index=network sourcetype=stream:tcp OR sourcetype=bro:ssl
| search dest_port=443 process_name="node.exe"
| where ssl_cert_issuer != "Trusted CA" OR ssl_validation_status != "OK"
| stats count by src_ip, dest_ip, dest_port, process_name
| where count > 0

Wazuh OSSEC Rule

<group name="fastify,">
  <rule id="100100" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">network_connection</field>
    <field name="process">node.exe</field>
    <field name="dest_port">443</field>
    <field name="tls_validation">false</field>
    <description>CVE-2026-107318: Possible @fastify/reply-from TLS certificate validation bypass detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Upgrade @fastify/reply-from to version 12.7.0 or later, where the rejectUnauthorized default has been corrected.
   • If upgrading is not immediately possible, explicitly set rejectUnauthorized: true on the transport configuration.
   • Alternatively, supply an already configured undici instance or use the undici global agent with proper TLS validation enabled.
   • As a temporary workaround, avoid using the plugin for HTTPS upstreams until patched, or implement an external proxy that enforces certificate validation.

2. Patch/upgrade steps:

   • Run npm update @fastify/reply-from or manually update the package.json to specify "@fastify/reply-from": "^12.7.0".
   • Verify the installed version with npm list @fastify/reply-from.
   • Re-deploy the application and test that HTTPS upstreams are correctly validated.

3. Long-term hardening:

   • Implement network segmentation and encryption to prevent on-path attackers from intercepting traffic.
   • Enforce certificate pinning where feasible to add an extra layer of validation.
   • Regularly audit dependencies for security misconfigurations using tools like npm audit or SCA solutions.
   • Monitor for anomalous TLS certificates and unexpected network connections from Node.js processes.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-107318
• GitHub Advisory: https://github.com/fastify/fastify-reply-from/security/advisories (search for CVE-2026-107318)
• Fastify Reply-From Repository: https://github.com/fastify/fastify-reply-from
• CWE-295: https://cwe.mitre.org/data/definitions/295.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence identified at this time. CISA KEV: NO.