CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213

The @fastify/http-proxy Fastify plugin (versions 9.0.0 through 11.6.5 ) is vulnerable to a path-restriction bypass. When using parameterized prefix and rewritePrefix options, the plugin substitutes URL-decoded route parameters into the prefix without re-encoding them. This allows an unauthenticat...