Skip to content
OpenAdvisories

Vendor

@fastify/http-proxy

5 known vulnerabilities.

Products

@fastify/http-proxy 5
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2026-120214

    @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

    @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a p…

    @fastify/http-proxy @fastify/http-proxy