CVE-2026-120213

A flaw was found in @fastify/http-proxy. When applications configure path rewriting using route parameters, the plugin fails to re-encode decoded URL parameters before constructing upstream request paths. An unauthenticated remote attacker can exploit this flaw by sending requests containing...

CVE-2026-120214

A flaw was found in @fastify/http-proxy. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by bypassing intended proxy routing restrictions. Due to improper path validation that processes backslashes before decoding request paths, encoded backslashes and...

CVE-2026-120214

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

@aaroncadillac/oidc-reverse-proxy (>=1.1.0, <=2.1.0), @alignable/bifrost-fastify (>=1.0.5, <=1.0.35) +88 more potentially affected by CVE-2026-120213 via @fastify/http-proxy (>=11.1.2, <=11.6.5)

@fastify/http-proxy NPM version =11.1.2, =1.1.0, =1.0.5, =0.0.0-test-darwin-x64.1, =0.0.0-test-darwin-x64.1, =2.0.16, =1.0.0-canary.12281, =5.0.7-next.219, =1.0.0-canary.12281, =5.0.4-next.167, =1.0.0-canary.12281, =1.0.0-canary.12281, =4.0.0-canary.13864, =4.0.0-canary.13864, =1.0.0-canary.12281...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213

The @fastify/http-proxy Fastify plugin (versions 9.0.0 through 11.6.5 ) is vulnerable to a path-restriction bypass. When using parameterized prefix and rewritePrefix options, the plugin substitutes URL-decoded route parameters into the prefix without re-encoding them. This allows an unauthenticat...

EUVD-2026-115117

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120214

The @fastify/http-proxy Fastify plugin (versions 11.6.0 through 11.6.2 ) is vulnerable to a path traversal issue where destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path with encoded backslashes and dot-segments to bypass security ch...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

EUVD-2026-115115

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120214: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

PT-2026-135398

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.0.0 through 11.6.5 Description When an application utilizes parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into...

@fastify/http-proxy path traversal vulnerability

A security vulnerability exists in Fastify HTTP Proxy versions 9.0.0 through 11.6.5. It arises from the failure to re-encode URL decoded routing parameters when they are used in rewritePrefix. Consequently, encoded path separators and query separators are decoded into actual separators, allowing...

CVE-2026-120213: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...