CVE-2026-120214 in http-proxy
Summary
by MITRE • 11/02/2026
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in @fastify/http-proxy versions 11.6.0 through 11.6.2 represents a critical path traversal flaw rooted in the incorrect ordering of input normalization and validation steps during HTTP request proxying. This plugin is designed to forward incoming requests from Fastify applications to an upstream server, typically restricting access to resources located within a specific configured prefix. The core technical failure lies in how the destination URL is processed before being forwarded. Specifically, the software performs path normalization on literal backslashes prior to percent-decoding the request URI. This sequence allows attackers to exploit platforms where the forward slash and backslash are both treated as valid path separators by the underlying operating system or web server infrastructure. By encoding a backslash character within the URL path using percent-encoding techniques, an attacker can bypass the initial validation logic that checks for dot-segments such as double dots intended to traverse directory levels.
The operational mechanism of this exploit relies on the discrepancy between how Fastify validates the path and how the upstream server interprets it. When a request contains a percent-encoded backslash sequence representing a parent directory traversal, the plugin's internal check sees only encoded characters or literal forward slashes that appear safe relative to the configured prefix. Once the validation passes, the subsequent decoding step converts these encoded sequences into actual backslashes. If the upstream environment treats backslashes as path separators, this conversion effectively allows the request to escape the intended sandboxed directory structure. Consequently, an unauthenticated remote attacker can craft malicious requests that traverse out of the restricted proxy prefix and access sensitive files or endpoints located in sibling directories on the upstream server. This results in a breach of confidentiality, exposing internal resources that were not meant to be accessible through this specific proxy route.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately sanitize user-supplied input before processing it for path resolution. It also relates closely to CWE-78 OS Command Injection in terms of its impact on system resource access, although strictly applied here to file system paths rather than shell commands. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Path Traversal or Directory Indexing, where an adversary leverages improper input handling to navigate outside restricted directories. The issue is particularly insidious because it serves as a follow-up to a previous security fix that addressed literal backslash usage but neglected to account for encoded variants, highlighting the complexity of securing path resolution logic across different platform-specific interpretations of special characters.
To mitigate this risk and prevent further exploitation, immediate action is required by upgrading @fastify/http-proxy to version 11.6.3 or any later release where the validation order has been corrected. The fix ensures that percent-decoding occurs before destination validation, thereby neutralizing encoded backslash attacks at the source. In addition to software updates, developers should implement defense-in-depth strategies such as strict allow-listing of permitted upstream paths and avoiding reliance on platform-specific path separator behaviors by normalizing all separators to forward slashes early in the request pipeline. Regular security audits focusing on URL parsing logic are recommended to ensure that future updates do not reintroduce similar ordering vulnerabilities or overlook encoded edge cases in other parts of the application stack.