Cpe:2.3:a:fastify:http-Proxy:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afastifyhttp-proxynode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 11:28:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFastify: Path restriction bypass in @fastify/http-proxy (CVE-2026-120213)https://feed.craftedsignal.io/briefs/2026-11-fastify-http-proxy-bypass/Mon, 02 Nov 2026 11:28:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fastify-http-proxy-bypass/The @fastify/http-proxy plugin fails to re-encode parameterized route parameters when using rewritePrefix, allowing remote attackers to inject path separators or delimiters to bypass path restrictions and access unauthorized upstream resources.The @fastify/http-proxy plugin, versions 9.0.0 through 11.6.5, contains a path-restriction bypass vulnerability. When the plugin is configured with parameterized prefix and rewritePrefix options, it fails to correctly re-encode URL-decoded parameters before they are used in the upstream proxy path. An attacker can inject URL-encoded path separators (e.g., %2f) or query delimiters that decode into active separators on the server, allowing the proxy to direct requests to unintended upstream endpoints. This flaw enables SSRF and authorization bypass in backend services that rely on the proxy to enforce path constraints.

Impact

The vulnerability allows unauthenticated remote attackers to reach upstream locations outside the intended prefix. Observed impacts include path-restriction bypass, server-side request forgery (SSRF), and potential authorization bypass in the proxied service.

Recommendation

Upgrade @fastify/http-proxy to version 11.6.6 or later immediately. There are no available workarounds; patching is required to address the injection flaw.

]]>criticaladvisory