CVE-2026-15631

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.4.0 through 11.5.0

Description WebSocket destination paths are not properly validated against the configured rewrite prefix. The WebSocketProxy.findUpstream() function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the ws package normalize paths before transmission.

Recommendations Upgrade @fastify/http-proxy to version 11.6.0.