Executive brief
@fastify/http-proxy is a reverse proxy plugin for the Fastify web framework that forwards requests to upstream servers while applying security boundaries via prefix and path rewriting rules. An unauthenticated attacker can bypass these boundary restrictions using backslash characters in the request path, allowing them to reach internal upstream endpoints that should remain hidden, exposing sensitive services and data.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in @fastify/http-proxy versions before 11.6.2. The HTTP request handler fails to validate proxied paths against the prefix and rewritePrefix boundaries, while the underlying reply-from library only rejects forward-slash traversal sequences (e.g., /../). An attacker can craft requests using backslash dot-segments (e.g., /pub/dir\..\..\secret) which are normalized by the URL parser as path separators, allowing the path to escape the intended security boundary. No authentication or user interaction is required; the vulnerability is exploitable over the network by sending a specially crafted HTTP request. An attacker can access upstream paths meant to be hidden, potentially achieving SSRF or authorization bypass in the proxied service. The patch is available in version 11.6.2 and later.
Affected products
- OpenJS Foundation @fastify/http-proxy before 11.6.2
Timeline
- 2026-09-03: disclosed: CVE-2026-85124 published
- 2026-09-03: patched: Version 11.6.2 released with fix