Back to Database
Status published
Medium
CVE-2023-51701
@fastify-reply-from JSON Content-Type parsing confusion
Vulnerability Description
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-51701
Credits & Attribution
No credits recorded in the NVD database.
References
More from fastify
View All →CVE-2025-66415
fastify-reply-from bypass of reply forwarding
Medium
6.9
CVE-2025-32442
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
High
7.5
CVE-2025-24033
@fastify/multipart vulnerable to unlimited consumption of resources
High
7.5
CVE-2024-35220
@fastify/session reuses destroyed session cookie
High
7.4
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
High
7.4
Affected Vendor
fastify
View all reports →Affected Software
fastify-reply-from
Vulnerable Versions:
< 9.6.0
Timeline
Official Publish:
January 8th, 2024
Last Modified:
June 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N