CVE-2025-48865

Fabio (fabio) is an HTTP(S) and TCP router for deploying Consul-managed apps. Prior to version 1.6.6, it mishandles hop-by-hop headers, allowing clients to remove or modify X-Forwarded headers (e.g., X-Forwarded-Host, X-Forwarded-Port) that Fabio injects when routing to backends. The attack relie...