Fastify: Path restriction bypass in @fastify/http-proxy (CVE-2026-120213)

The @fastify/http-proxy plugin, versions 9.0.0 through 11.6.5, contains a path-restriction bypass vulnerability. When the plugin is configured with parameterized prefix and rewritePrefix options, it fails to correctly re-encode URL-decoded parameters before they are used in the upstream proxy path. An attacker can inject URL-encoded path separators (e.g., %2f) or query delimiters that decode into active separators on the server, allowing the proxy to direct requests to unintended upstream endpoints. This flaw enables SSRF and authorization bypass in backend services that rely on the proxy to enforce path constraints.

Impact

The vulnerability allows unauthenticated remote attackers to reach upstream locations outside the intended prefix. Observed impacts include path-restriction bypass, server-side request forgery (SSRF), and potential authorization bypass in the proxied service.

Recommendation

Upgrade @fastify/http-proxy to version 11.6.6 or later immediately. There are no available workarounds; patching is required to address the injection flaw.