CVE-2026-117518 @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...

CVE-2026-117518

The @fastify/reply-from Fastify plugin (versions up to and including 12.8.0 ) is vulnerable to a path traversal issue. The plugin fails to account for backslash dot-segments during path validation, as the WHATWG URL parser normalizes backslashes (and their percent-encoded forms) to forward slashe...

EUVD-2026-70381

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...