PT-2026-135398

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.0.0 through 11.6.5 Description When an application utilizes parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into...

@fastify/http-proxy path traversal vulnerability

A security vulnerability exists in Fastify HTTP Proxy versions 9.0.0 through 11.6.5. It arises from the failure to re-encode URL decoded routing parameters when they are used in rewritePrefix. Consequently, encoded path separators and query separators are decoded into actual separators, allowing...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal through the HTTP request path handling in index.js, including fastifyHttpProxy and reply.fromParameters. An attacker can bypass rewritePrefix path restriction...

CVE-2026-16117: Improper Input Validation

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...