Executive brief
@fastify/http-proxy is a tool used to forward web traffic from one server to another, often used to hide internal services or simplify web addresses. A security flaw in how it handles WebSocket connections allows an attacker to bypass intended access restrictions and reach internal or administrative endpoints that should be hidden. This could lead to unauthorized access to sensitive internal data or services.
Technical details
The vulnerability is a path traversal variant of CVE-2021-21322 specifically affecting the WebSocket code path in WebSocketProxy.findUpstream. The component uses the WHATWG URL constructor to resolve destination paths, which automatically collapses dot segments (e.g., '/../'). Because the proxy fails to validate the resolved path against the configured rewrite prefix, a crafted upgrade request can reach upstream WebSocket endpoints outside the intended directory. Exploitation requires a non-normalizing WebSocket client or a downstream proxy that forwards raw request targets, as standard browsers typically normalize paths before transmission. A fix is available in version 11.6.0.
Affected products
- Fastify @fastify/http-proxy >= 9.4.0, <= 11.5.0
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory
- 2026-07-18: patched: Fixed in version 11.6.0