CVE-2026-120214

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 11.6.0 through 11.6.2

Description Destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path containing encoded backslashes and dot-segments to bypass the dot-segment check. If the upstream server treats a backslash as a path separator, the forwarded request can escape the configured proxy prefix to access sibling locations on the upstream. An unauthenticated remote attacker can exploit this to retrieve resources outside the intended prefix, impacting confidentiality.

Recommendations Upgrade to version 11.6.3 or later.