CVE-2026-120213

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.0.0 through 11.6.5

Description When an application utilizes parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. An unauthenticated remote attacker can provide a parameter value encoding a path separator with a fragment or query delimiter. This decodes into actual separators and delimiters that inject additional upstream path segments and remove the mandatory suffix the rewritePrefix was intended to enforce. This allows the attacker to reach upstream locations outside the intended prefix, resulting in path-restriction bypass, which may lead to server-side request forgery (SSRF) or authorization bypass in the proxied service.

Recommendations Update to version 11.6.6 or later.