CVE-2026-85124

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.2

Description An unauthenticated network attacker can exploit a path traversal issue where proxied HTTP request paths are not validated for backslash-based dot-segments before being forwarded to the upstream server. The plain HTTP request handler bypasses the destination validation used by WebSocket paths, and the underlying reply-from library only rejects forward-slash traversal. This allows requests containing backslash dot-segments to escape the boundaries defined by the prefix and rewritePrefix options, enabling access to internal upstream paths and the disclosure of hidden endpoints.

Recommendations Upgrade to @fastify/http-proxy version 11.6.2 or later.