CVE-2026-85124: fallo de gravedad alta en @fastify/http-proxy
@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.7%
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
@fastify/http-proxy · @fastify/http-proxyCVEs relacionadas — @fastify/http-proxy
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-120213CRITICAL@fastify/http-proxy vulnerable to prefix escape via decoded route parametersEPSS 0.7%CVE-2026-15631HIGH@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversalEPSS 0.5%CVE-2026-120214MEDIUM@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segmentsEPSS 0.5%CVE-2026-16117CRITICAL@fastify/http-proxy vulnerable to prefix escape via URL-encoded charactersEPSS 0.4%