CVE-2026-120214

The @fastify/http-proxy Fastify plugin (versions 11.6.0 through 11.6.2 ) is vulnerable to a path traversal issue where destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path with encoded backslashes and dot-segments to bypass security ch...