CVE-2026-85124@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
Updated under an hour ago ()
Does this affect you?
It affects @fastify/http-proxy and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Analyzed
- Record last updated
- Sep 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
@fastify/http-proxy @fastify/http-proxy fastify_http_proxy:fastify_http_proxy (from the name) | before 11.6.2; 11.6.2 not affected | CNA record |
fastify fastify/http-proxy fastify:fastify/http-proxy | before 11.6.2 | NVD |
References
- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5vendor-advisory
- https://cna.openjsf.org/security-advisories.htmlthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.