CVE-2025-48865 is a critical flaw (CVSS 9.1) in Fabio, the HTTP and TCP router for Consul managed applications. Versions up to 1.6.5 let clients remove forwarding headers that backends trust. Fabio 1.6.6 fixes it. Upgrade, and stop backends from trusting those headers without a check.
What's affected
The GitHub advisory for Fabio lists the Go module github.com/fabiolb/fabio, versions up to and including 1.6.5, with 1.6.6 as the patched release. The CVE record agrees: everything before 1.6.6 is affected.
The advisory says the issue is in how Fabio processes hop-by-hop headers. Fabio adds headers such as X-Forwarded-Host and X-Forwarded-Port when it routes a request to a backend. A client can name headers in the Connection header, which tells the proxy to treat them as hop-by-hop, and Fabio then removes them. The advisory lists X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto, X-Real-Ip and Forwarded as headers that can be removed this way. X-Forwarded-For is the exception.
The advisory also notes similar bugs in other proxies, naming CVE-2022-31813 in Apache HTTP Server and CVE-2024-45410 in Traefik.
How to check if you're exposed
Find where Fabio runs and which version it is. For containers, look at the image tag:
docker image ls fabiolb/fabio
For a binary, check the release you deployed, or the release listed in your deployment tooling. If you build from source, check the Go module version:
go list -m github.com/fabiolb/fabio
If the version is 1.6.5 or older, you are affected. Then ask a second question: which backend applications read X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port, X-Real-Ip or Forwarded to make decisions? Examples are building absolute URLs, deciding whether a request arrived over HTTPS, applying IP based rules, or generating password reset links. Those are the applications where a missing or altered header changes behaviour.
What to do now
- List every Fabio deployment and its version.
- Upgrade to 1.6.6 or later and roll it out to all instances behind your load balancers.
- Review the backends that trust forwarding headers. Where possible, configure them to accept those headers only from your proxy tier, and set safe defaults when a header is missing.
- Do not use a forwarding header as the only basis for an access decision.
- Check proxy and backend logs for requests that name forwarding headers in a Connection header, if you log request headers.
Why it matters
The weaknesses are listed as CWE-345, insufficient verification of data authenticity, and CWE-348, use of a less trusted source. The proxy adds headers to describe the original request. The backend believes them because they come from the proxy. If a client can make the proxy delete those headers, the backend sees a request that looks different from the real one, and in some cases the advisory says the headers can be manipulated rather than just removed.
The impact depends entirely on what your applications do with the headers. For some it is nothing. For others it can bypass HTTPS enforcement, host based routing, or IP restrictions. That spread is why the CVSS score is high while the practical risk differs between estates.
This is not on the CISA Known Exploited Vulnerabilities list. Reachability analysis helps here in a practical way: it can tell you which of your services actually sit behind the affected router and use the affected headers, so you fix those first.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Fabio version fixes this?
Version 1.6.6. The advisory lists versions up to 1.6.5 as affected.
Is X-Forwarded-For also removable?
The advisory says X-Forwarded-For is the exception to the headers that can be removed this way.
Sources
Last reviewed: 18 October 2026.
