# Fastify's connection header abuse enables stripping of proxy-added headers

Fastify reply-from/http-proxy processes client Connection header after rewriteRequestHeaders, letting attackers strip proxy-added auth/routing headers from upstream requests.

- Payout: Research
- Severity: critical
- Program: Fastify
- Found by (vendor credit): FredKSchott
- Found by: FredKSchott
- Disclosed: 2026-04-16
- CVE: CVE-2026-33805
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gwhp-pf74-vj37
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37
- Tags: area:oss domain:oss impact:privesc kind:research platform:ghsa sev:critical tech:nodejs technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** Node.js HTTP proxy plugins (@fastify/reply-from, @fastify/http-proxy)
**Root cause:** Client headers including `connection` are copied before `rewriteRequestHeaders` adds proxy headers, then the transport strips headers named in the client's Connection header afterward, removing proxy-added headers.
**Steps:**
1. Set up upstream echo service and proxy using `@fastify/reply-from` with `rewriteRequestHeaders` adding `x-forwarded-by: fastify-proxy`.
2. Baseline request `GET /proxy/api/echo-headers` shows upstream receives `x-forwarded-by`.
3. Send `GET /proxy/api/echo-headers` with header `connection: x-forwarded-by`.
4. Upstream no longer receives `x-forwarded-by`; multiple headers strippable via `Connection: x-forwarded-by, x-forwarded-for`.
**How found:** Code review of the header processing order in `@fastify/reply-from/lib/request.js` and `index.js`, noticing Connection-header stripping runs after `rewriteRequestHeaders` instead of before, contrary to RFC 7230 Section 6.1.
**Exploitation:** Attacker sends requests through the proxy with a crafted `Connection` header listing security-relevant headers the proxy injects (e.g. `x-internal-auth`, `x-proxy-token`, `authorization`), causing them to be stripped before reaching upstream, bypassing access control or proxy-identification checks.
**Insight:** When auditing proxies, check the ordering of hop-by-hop Connection-header stripping relative to header-injection hooks; if stripping runs after injection, client-controlled Connection values can delete trusted headers.

## Proof of concept (copied exactly from the original report)

**Attack request with Connection header stripping proxy header**

```
const res2 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers',
    headers: { 'connection': 'x-forwarded-by' }
  });
  console.log('\nAttack response headers from upstream:');
  const body2 = JSON.parse(res2.body);
  console.log('  x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');
```