Read the docs
TI-2026-13153 Aliases CVE-2026-15631

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

Priority MEDIUM 43CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix Fixed @fastify/http-proxy (@fastify/http-proxy): 11.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/http-proxy9.4.0 to before 11.6.011.6.0Patch availableCNA
  • @fastify/http-proxy Vendorfastify Affected 9.4.0 to before 11.6.0 Fixed in 11.6.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/http-proxy:*:*:*:*:*:node.js:*:*9.4.0 to before 11.6.0Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/http-proxy:*:*:*:*:*:node.js:*:* Versions 9.4.0 to before 11.6.0 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/http-proxy (@fastify/http-proxy) Fixed in 11.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/http-proxy 11.6.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-13487 @fastify/http-proxy vulnerable to prefix escape via URL-encoded charactersPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15631

References

Advisory 2

  • TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
  • TI-2026-13487 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters CVSS 3.1CRITICAL 10.0
  • TI-2026-58468 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences