Prefix escape in @fastify/http-proxy via encoded backslash paths
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
@fastify/http-proxy versions from 11.6.0 before 11.6.3 are affected. The destination validation normalizes literal backslashes before it percent-decodes the request path, so encoded backslashes and dot-segments pass the dot-segment check (CWE-22). When the upstream treats a backslash as a path separator, an unauthenticated remote attacker can retrieve upstream resources outside the configured proxy prefix, which affects confidentiality only.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade @fastify/http-proxy to 11.6.3 or later. Red Hat lists OpenShift AI (RHOAI) and OpenShift Dev Spaces as affected products with no available fix plan.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA @fastify/http-proxy (@fastify/http-proxy) Fixed in 11.6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120214
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
References
More fastify vulnerabilities
- TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
- TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
- TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
Sources
- CVE-2026-120214 · CVE Program
- CVE-2026-120214 · NVD
- FIRST EPSS
- CVE-2026-120214 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences