CVE-2026-120213

The @fastify/http-proxy Fastify plugin (versions 9.0.0 through 11.6.5 ) is vulnerable to a path-restriction bypass. When using parameterized prefix and rewritePrefix options, the plugin substitutes URL-decoded route parameters into the prefix without re-encoding them. This allows an unauthenticat...