Vulnerabilities

TI-2026-58468 CVE-2026-85124

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

MEDIUM 40

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00737 Published 2026-09-03 Partial fix · 11.6.2 CWE-22

TI-2026-13487 CVE-2026-16117

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

MEDIUM 49

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00444 Published 2026-07-18 Fixed in 11.6.0 CWE-20

TI-2026-13153 CVE-2026-15631

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

MEDIUM 43

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00501 Published 2026-07-18 Fixed in 11.6.0 CWE-22

TI-2026-26177 CVE-2026-33805 · GHSA-gwhp-pf74-vj37

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

HIGH 78

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00441 Published 2026-04-15 Fixed in 12.6.2, 11.4.4 CWE-644

Vulnerabilities

Filters

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers