CVE-2026-85124 in fastifyhttpproxy
Summary
by MITRE • 09/03/2026
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in versions of @fastify/http-proxy prior to 11.6.2 represents a critical path traversal flaw rooted in inconsistent input validation logic within the proxy middleware. The core issue stems from the disparity between how HTTP requests and WebSocket connections are processed by the library. While the WebSocket handler implements robust destination validation that effectively restricts access to authorized upstream paths, the plain HTTP request handler lacks this same level of scrutiny. This architectural inconsistency creates a security gap where attackers can exploit differences in path normalization behavior across different protocols supported by the proxy server. The underlying reply-from library, which handles the actual forwarding of requests, is configured to reject forward-slash based directory traversal attempts such as ../ sequences. However, it fails to adequately sanitize or normalize backslash-based dot-segments like ..\, a common oversight in systems that do not strictly enforce cross-platform path canonicalization before processing.
This technical flaw allows an unauthenticated network attacker to bypass the security boundaries established by configuration options such as prefix and rewritePrefix. By crafting HTTP requests containing carefully constructed paths with backslashes and dot segments, an adversary can escape the intended proxy boundary and access internal upstream endpoints that were meant to remain hidden from external users. For instance, a request targeting /api/internal might be manipulated using path traversal sequences like /..\ or /\..\\ to reach sensitive administrative interfaces, configuration files, or other backend services located outside the designated proxied area. This capability effectively neutralizes the protective layer provided by the reverse proxy, exposing internal network architecture and potentially leading to unauthorized data disclosure or further exploitation of downstream systems that trust requests originating from the proxy.
The operational impact of this vulnerability is significant, particularly in environments where @fastify/http-proxy serves as a gateway for sensitive microservices or administrative panels. The ability to reach hidden upstream paths can lead to the exposure of internal API endpoints, source code repositories, database management interfaces, and other critical infrastructure components. Attackers leveraging this flaw can perform reconnaissance to map out the internal network topology, identify additional attack surfaces, and potentially escalate privileges by accessing services that do not require authentication or rely on IP whitelisting from the proxy server itself. This scenario aligns with CWE-22, which classifies improper limitation of a pathname to a restricted directory as an insecure path traversal vulnerability. Furthermore, this exploitation technique is consistent with ATT&CK techniques related to Path Traversal and potentially Initial Access if it leads to unauthorized entry into internal systems.
To mitigate this risk, organizations must immediately upgrade @fastify/http-proxy to version 11.6.2 or later, where the developers have addressed these validation gaps by ensuring that both HTTP and WebSocket handlers apply consistent path normalization rules. Until an upgrade is feasible, administrators should implement additional security controls at the network perimeter level, such as configuring web application firewalls to block requests containing backslash-based traversal sequences. It is also advisable to review proxy configurations to ensure that upstream services enforce their own strict access control policies rather than relying solely on the proxy for boundary enforcement. Regular auditing of path handling logic in middleware components and adopting a defense-in-depth strategy will help prevent similar vulnerabilities from being exploited in future deployments.