CVE-2026-85124: @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/http-proxyto a version that resolves this vulnerability.Fixed in 11.6.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @fastify/http-proxy before 11.6.2 are affected when they forward plain HTTP requests to an upstream and rely on prefix or rewritePrefix settings to restrict which upstream paths can be reached. The issue is in the plain HTTP request handler; the WebSocket path performs destination validation.
What does an attacker need to exploit this?
An unauthenticated attacker only needs network access to send an HTTP request through the proxy. They can use backslash-based dot-segments in the request path to bypass the intended prefix boundary and reach hidden upstream paths.
What is the recommended remediation?
Upgrade @fastify/http-proxy to version 11.6.2 or later. The affected versions are those before 11.6.2.