Fastify Reply-From Cache Key Collision Enables Cross-Upstream Access

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-16158 affects @fastify/reply-from versions 8.3.1 through 12.6.3, introducing a critical cache poisoning vulnerability in how upstream URL routing is handled. The flaw stems from improper cache key construction—concatenating destination and source paths without delimiters allows different upstream-source combinations to collide and map to identical cache keys. When the getUpstream function selects an upstream based on request data, previously cached responses intended for one upstream server can be reused for requests targeting a different upstream, enabling unauthorized data access and modification across upstream boundaries. This affects any organization using vulnerable versions of this Fastify reply proxy middleware, particularly those routing requests across multiple upstream services or multi-tenant architectures where upstream isolation is critical.

Casky's 331 mapped security skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Execution (TA0006) phases. Practitioners using Casky would identify suspicious activity patterns including: anomalous cross-upstream data flows where response data from one upstream appears in requests targeting another; cache timing inconsistencies where identical requests resolve differently based on prior request sequences; and privilege escalation indicators where low-privilege upstream requests unexpectedly return data scoped to higher-privilege upstreams. The platform's skills would flag CWE-441 (Unintended Proxy/Intermediary) violations by detecting when cached responses bypass intended access controls, correlating request headers, destination URLs, and upstream identifiers to expose the collision patterns that enable unauthorized data movement between isolated service boundaries.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16158.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-16158

Casky has 331 skills that investigate the attack patterns behind CVE-2026-16158. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn