Universe-Theori

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

**Name of the Vulnerable Software and Affected Versions** @fastify/http-proxy versions 9.4.0 through 11.5.0 **Description** WebSocket destination paths are not properly validated against the configured rewrite prefix. The `WebSocketProxy.findUpstream()` function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the `ws` package normalize paths before transmission. **Recommendations** Upgrade @fastify/http-proxy to version 11.6.0.