Skip to content
OpenAdvisories

Vendor

@fastify/http-proxy

5 known vulnerabilities.

Products

@fastify/http-proxy 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-120213

    @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

    @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream pa…

    @fastify/http-proxy @fastify/http-proxy
  • Critical 10.0
    CVE-2026-16117

    @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

    Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix…

    @fastify/http-proxy @fastify/http-proxy