Vulnerability Description
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fastify | Fastify\/Http-Proxy | < 11.6.2 |
Related Weaknesses (CWE)
References
- https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689pVendor Advisory
FAQ
What is CVE-2026-85124?
CVE-2026-85124 is a vulnerability with a CVSS score of 7.5 (HIGH). @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler...
How severe is CVE-2026-85124?
CVE-2026-85124 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85124?
Check the references section above for vendor advisories and patch information. Affected products include: Fastify Fastify\/Http-Proxy.