Is CVE-2026-85124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85124 being exploited in the wild.

How severe is CVE-2026-85124?

High severity, with a CVSS score of 7.5, published 3 September 2026.

Which products and versions are affected?

OpenJS Foundation @fastify/http-proxy before 11.6.2.

Is there a fix for CVE-2026-85124?

A patch was published on 2026-09-03: Version 11.6.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85124 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85124?

Check whether you run Fastify Http-Proxy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85124: @fastify/http-proxy path traversal via backslash dot-segments

CVE-2026-85124 · Severity: high · CVSS 7.5 · Published 2026-09-03

@fastify/http-proxy is a reverse proxy plugin for the Fastify web framework that forwards requests to upstream servers while applying security boundaries via prefix and path rewriting rules. An unauthenticated attacker can bypass these boundary restrictions using backslash characters in the request path, allowing them to reach internal upstream endpoints that should remain hidden, exposing sensitive services and data.

Technologies: Fastify Http-Proxy. Vendors: Fastify.

Quick answers

Is CVE-2026-85124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85124 being exploited in the wild.
How severe is CVE-2026-85124?: High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?: OpenJS Foundation @fastify/http-proxy before 11.6.2.
Is there a fix for CVE-2026-85124?: A patch was published on 2026-09-03: Version 11.6.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85124 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85124?: Check whether you run Fastify Http-Proxy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-22) in @fastify/http-proxy versions before 11.6.2. The HTTP request handler fails to validate proxied paths against the prefix and rewritePrefix boundaries, while the underlying reply-from library only rejects forward-slash traversal sequences (e.g., /../). An attacker can craft requests using backslash dot-segments (e.g., /pub/dir\..\..\secret) which are normalized by the URL parser as path separators, allowing the path to escape the intended security boundary. No authentication or user interaction is required; the vulnerability is exploitable over the network by sending a specially crafted HTTP request. An attacker can access upstream paths meant to be hidden, potentially achieving SSRF or authorization bypass in the proxied service. The patch is available in version 11.6.2 and later.

Affected products

OpenJS Foundation @fastify/http-proxy before 11.6.2

Timeline

2026-09-03: disclosed: CVE-2026-85124 published
2026-09-03: patched: Version 11.6.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.