Read the docs
TI-2026-13487 Aliases CVE-2026-16117

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Priority MEDIUM 49CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed @fastify/http-proxy (@fastify/http-proxy): 11.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/http-proxybefore 11.6.011.6.0Patch availableCNA
  • @fastify/http-proxy Vendorfastify Affected before 11.6.0 Fixed in 11.6.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/http-proxy:*:*:*:*:*:node.js:*:*before 11.6.0Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/http-proxy:*:*:*:*:*:node.js:*:* Versions before 11.6.0 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/http-proxy (@fastify/http-proxy) Fixed in 11.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/http-proxy 11.6.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-13153 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversalPriority MEDIUM 43
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16117

References

Advisory 2

  • TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
  • TI-2026-13153 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal CVSS 3.1CRITICAL 10.0
  • TI-2026-58468 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences