CPE
The @fastify/http-proxy plugin fails to re-encode parameterized route parameters when using rewritePrefix, allowing remote attackers to inject path separators or delimiters to bypass path restrictions and access unauthorized upstream resources.