CVE-2026-85124

What it is

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-03 13:06 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-09 19:25 UTC Last updatedMost recent change to the record

Details

Published

2026-09-03 13:06 UTC

Last modified

2026-09-09 19:25 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Analyzed

Affected

• Fastify fastify\/http-proxy < 11.6.2

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None