CVE-2026-120213
CriticalCVSS 9.1Summary
@fastify/http-proxy versions 9.0.0 through 11.6.5 substitute URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator with a fragment or query delimiter decodes into real separators, injecting extra upstream path segments and stripping the mandatory suffix. An unauthenticated remote attacker can reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, SSRF or authorization bypass.
Risk Assessment
An attacker can bypass proxy path restrictions and reach unintended upstream resources, potentially exposing data or bypassing access controls in the proxied service. Exploitation requires a single unauthenticated request, making the risk high for applications using parameterized prefixes.
Recommendation
Upgrade @fastify/http-proxy to version 11.6.6 or later. There is no workaround other than upgrading.
Other vulnerabilities in @fastify/http-proxy
See all- CVE-2026-120214Medium
@fastify/http-proxy versions 11.6.0 through 11.6.2 normalize literal backslashes before percent-decoding the request path, so a path encoding backslashes and dot-segments survives the dot-segment check and only becomes backslash and double-dot sequences afterward. When the upstream treats backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling upstream location.
- CVE-2026-16117Critical
A vulnerability in @fastify/http-proxy up to version 11.5.0 causes the request prefix not to be rewritten when the prefix segment is URL-encoded. Fastify URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request encoding one or more characters of the configured prefix matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged, allowing an attacker to reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.
- CVE-2026-85124High
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
- CVE-2026-15631High
In @fastify/http-proxy versions 9.4.0 through 11.5.0, the resolved WebSocket destination path is not validated against the configured rewrite prefix. Attackers can use path traversal sequences to bypass the prefix and reach unintended upstream endpoints.
Original NVD description (English source)
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS