CVE-2026-117518

A flaw was found in @fastify/reply-from. The plugin only validates forward-slash dot-segments, allowing backslash sequences to bypass traversal checks when the upstream destination URL is constructed. An unauthenticated remote attacker can exploit this vulnerability by submitting requests with...