CVE-2026-120213 in http-proxy
Summary
by MITRE • 11/02/2026
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in versions of the fastify-http-proxy plugin between 9.0.0 and 11.6.5 represents a critical security flaw rooted in improper handling of URL-encoded input during request proxying operations. This Fastify plugin is designed to forward HTTP requests from clients to an upstream server, typically under a specific configured prefix path. The core issue arises when the application utilizes parameterized prefixes alongside rewritePrefix options intended to restrict client access to fixed upstream paths. In these scenarios, the plugin incorrectly substitutes URL-decoded route parameters directly into the rewritePrefix configuration without performing subsequent re-encoding of those values. This failure in input sanitization allows attackers who supply specially crafted URLs containing encoded path separators and fragment or query delimiters to manipulate the resulting proxy destination.
From a technical perspective, the flaw exploits the difference between how web servers interpret raw URL strings versus their decoded counterparts. When an attacker provides a parameter value that encodes characters such as forward slashes or question marks, these are initially treated as literal parts of the route parameter by Fastify's routing mechanism. However, when fastify-http-proxy processes this data to construct the upstream request URI, it decodes the parameters before appending them to the rewritePrefix. Because the decoding occurs without re-encoding special characters like path separators or query delimiters, these encoded sequences are interpreted as actual structural elements of the URL rather than literal text. Consequently, an attacker can inject additional path segments into the upstream request and strip away mandatory suffixes that were originally enforced by the rewritePrefix configuration. This mechanism effectively bypasses the intended path restrictions without relying on traditional directory traversal techniques such as dot-dot-slash sequences.
The operational impact of this vulnerability is severe, primarily manifesting as a path-restriction bypass that allows unauthenticated remote attackers to access upstream locations outside the intended scope. By manipulating the proxy destination, an attacker can redirect requests to sensitive internal endpoints or administrative interfaces that were not meant to be exposed through the proxied route. Depending on the architecture and security controls of the upstream service, this capability can lead to server-side request forgery where the application is tricked into making unauthorized requests to other services within its network perimeter. Furthermore, if the upstream service relies on path-based authorization checks that are circumvented by injecting extra segments or removing required suffixes, attackers may achieve complete authorization bypass. This exposes internal APIs, configuration files, or user data to external parties who should not have access.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function within the Common Weakness Enumeration framework, as it involves a failure to properly validate and encode special characters in dynamic input before use in system commands or URL construction. In terms of attack patterns, this behavior is consistent with MITRE ATT&CK technique T1059 Command and Scripting Interpreter if interpreted broadly as command injection via web application parameters, but more accurately maps to T1622 Redirection Through Manipulation of Request-For-URL which describes how attackers manipulate URLs to redirect traffic or access unintended resources. The lack of proper encoding creates a vector for indirect object reference attacks where the attacker controls the resource identifier used by the proxy logic.
Mitigation strategies are straightforward but require immediate action due to the severity and remote exploitability of the flaw. There is no viable workaround such as input filtering at the application layer that can reliably prevent this issue without compromising legitimate functionality, given that valid use cases may involve complex URL structures. The definitive solution is to upgrade the fastify-http-proxy package to version 11.6.6 or later, where the developers have implemented proper re-encoding of decoded parameters before they are integrated into the upstream request path. Organizations relying on this plugin should prioritize patching their dependencies in CI/CD pipelines and verify that no older versions remain active in production environments. Additionally, implementing strict allow-lists for allowed proxy destinations at a network or reverse-proxy level can provide defense-in-depth against similar vulnerabilities in other components of the stack.