CVE-2026-120214: medium-severity vulnerability in @fastify/http-proxy
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.5%
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
@fastify/http-proxy · @fastify/http-proxyRelated CVEs — @fastify/http-proxy
In the same product, most dangerous first.
CVE-2026-85124HIGH@fastify/http-proxy vulnerable to prefix escape via backslash dot-segmentsEPSS 0.7%CVE-2026-120213CRITICAL@fastify/http-proxy vulnerable to prefix escape via decoded route parametersEPSS 0.7%CVE-2026-15631HIGH@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversalEPSS 0.5%CVE-2026-16117CRITICAL@fastify/http-proxy vulnerable to prefix escape via URL-encoded charactersEPSS 0.4%