# Proxy header stripping and forwarding confusion

Proxies that strip client-named headers after injecting their own, or forward arbitrary paths with vendor credentials

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; one confirmed bounty: $5,000; latest 2026-04-16. Updated 2026-11-02._

## How it works
A proxy is trusted to add or remove headers on the client's behalf. The assumption that breaks is that client-supplied headers and proxy-supplied headers occupy separate namespaces. When a proxy copies client headers first, then runs an injection hook, then strips hop-by-hop headers named in the client's `Connection` value, the client can name a proxy-added header and have it deleted after injection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md). A related shape: a proxy that forwards arbitrary upstream paths while injecting its own privileged credentials, so the client never authenticates at all [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md).

## Where it shows up
- Proxy code where `Connection`-named header stripping runs after a `rewriteRequestHeaders`/injection hook [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md)
- Client-supplied `Connection`, `Upgrade`, `Proxy-*`, `X-Forwarded-*` reaching upstream unfiltered
- First-party paths embedding a third-party SaaS API path, e.g. `/_api/zendesk/api/v2/` [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md)
- Server-side injection of vendor admin credentials on proxied routes [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md)
- Email relays that rewrite `From` and re-template the body, dropping DKIM/ARC [E3](https://bugbountylibrary.com/r/h1%3A2109320.md)

## How to review
State the invariant: headers the proxy adds must be immune to client influence, and hop-by-hop stripping must happen before any injection. Check the order of operations in the request pipeline, not just the presence of a strip function [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md). For path proxies, confirm the upstream path is allowlisted and that injected credentials are scoped to routes the client is authorized for [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md). For relays, confirm the original authentication result (DKIM/ARC/DMARC) is preserved or re-evaluated after rewriting [E3](https://bugbountylibrary.com/r/h1%3A2109320.md).

## How finders spotted it
- Noticed two `api` segments in a proxied help-center request, hypothesized a reverse proxy to the vendor, then tested whether arbitrary vendor API paths passed through and whether admin auth was injected server-side [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md)
- Read `@fastify/reply-from` request handling and saw Connection-header stripping ran after `rewriteRequestHeaders`, contrary to RFC 7230 Section 6.1 [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md)
- Reasoned that re-composition and `From` rewrite would invalidate DKIM/ARC, then tested spoofing against domains with DMARC none, quarantine and reject [E3](https://bugbountylibrary.com/r/h1%3A2109320.md)

## Variants seen
- Client `Connection` header deleting proxy-added auth/routing headers [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md)
- Path-embedded SaaS proxy injecting admin credentials for arbitrary upstream calls [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md)
- Email relay rewriting sender identity and stripping signatures [E3](https://bugbountylibrary.com/r/h1%3A2109320.md)

## Impact and severity
E1 exposed 276k support tickets and all user PII, with session tokens in tickets enabling account takeover; severity raised by server-side admin auth removing any client barrier [E1](https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md). E2 lets attackers strip proxy-added auth and routing headers, undermining upstream trust decisions [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md). E3 let spoofed mail bypass DMARC=reject and land in inboxes by borrowing the relay's reputation [E3](https://bugbountylibrary.com/r/h1%3A2109320.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **@fastify/reply-from (npm)** <= 12.6.1, fixed in 12.6.2: Fastify's connection header abuse enables stripping of proxy-added headers (CVE-2026-33805). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-gwhp-pf74-vj37.md
- E3: https://bugbountylibrary.com/r/h1%3A2109320.md