Skip to content
OpenAdvisories

Vendor

@fastify/http-proxy

5 known vulnerabilities.

@fastify/http-proxy at a glance

Last 12 months
5
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 2 vulnerabilities, 1 critical August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 2 vulnerabilities, 1 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202621
Oct 202600
Sep 202610
Aug 202600
Jul 202621
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

@fastify/http-proxy 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Critical 9.1
    CVE-2026-120213

    @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

    @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream pa…

    @fastify/http-proxy @fastify/http-proxy
  • Medium 5.9
    CVE-2026-120214

    @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

    @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a p…

    @fastify/http-proxy @fastify/http-proxy
  • High 7.5
    CVE-2026-85124

    @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

    @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path p…

    @fastify/http-proxy @fastify/http-proxy
  • Critical 10.0
    CVE-2026-16117

    @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

    Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix…

    @fastify/http-proxy @fastify/http-proxy
  • High 8.7
    CVE-2026-15631

    @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

    Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via t…

    @fastify/http-proxy @fastify/http-proxy