Is CVE-2026-15631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15631 being exploited in the wild.

How severe is CVE-2026-15631?

High severity, with a CVSS score of 8.7, published 18 July 2026.

Which products and versions are affected?

Fastify @fastify/http-proxy >= 9.4.0, <= 11.5.0.

Is there a fix for CVE-2026-15631?

A patch was published on 2026-07-18: Fixed in version 11.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15631?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15631: Fastify @fastify/http-proxy path traversal in WebSocket path resolution

Q: Is there a fix for CVE-2026-15631?

A patch was published on 2026-07-18: Fixed in version 11.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-15631 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-15631?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15631 · Severity: high · CVSS 8.7 · Published 2026-07-18

@fastify/http-proxy is a tool used to forward web traffic from one server to another, often used to hide internal services or simplify web addresses. A security flaw in how it handles WebSocket connections allows an attacker to bypass intended access restrictions and reach internal or administrative endpoints that should be hidden. This could lead to unauthorized access to sensitive internal data or services.

Quick answers

Is CVE-2026-15631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15631 being exploited in the wild.
How severe is CVE-2026-15631?: High severity, with a CVSS score of 8.7, published 18 July 2026.
Which products and versions are affected?: Fastify @fastify/http-proxy >= 9.4.0, <= 11.5.0.
Is there a fix for CVE-2026-15631?: A patch was published on 2026-07-18: Fixed in version 11.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15631?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal variant of CVE-2021-21322 specifically affecting the WebSocket code path in WebSocketProxy.findUpstream. The component uses the WHATWG URL constructor to resolve destination paths, which automatically collapses dot segments (e.g., '/../'). Because the proxy fails to validate the resolved path against the configured rewrite prefix, a crafted upgrade request can reach upstream WebSocket endpoints outside the intended directory. Exploitation requires a non-normalizing WebSocket client or a downstream proxy that forwards raw request targets, as standard browsers typically normalize paths before transmission. A fix is available in version 11.6.0.

Affected products

Fastify @fastify/http-proxy >= 9.4.0, <= 11.5.0

Timeline

2026-07-18: disclosed
2026-07-18: advisory
2026-07-18: patched: Fixed in version 11.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.