Skip to content
OpenAdvisories

Vendor

@fastify/http-proxy

5 known vulnerabilities.

Products

@fastify/http-proxy 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-85124

    @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

    @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path p…

    @fastify/http-proxy @fastify/http-proxy
  • High 8.7
    CVE-2026-15631

    @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

    Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via t…

    @fastify/http-proxy @fastify/http-proxy