CVE-2026-88829

A flaw in the BusyBox httpd reverse proxy feature allows an attacker to bypass path restrictions. When configured to forward requests matching a URL prefix, the proxy only rewrites the path for the first HTTP request on a TCP connection. By sending a pipelined second request , an attacker can cau...