CVE-2026-120214

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.

• CWE-22

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120206Thelia before 3.2.0 contains a cross-site request forgery vu…5.9
• CVE-2026-120207Thelia Page Module before 2.0.4 contains a cross-site reques…7.1
• CVE-2026-120208libheif 1.18.0 before 1.23.3 contains a heap-based buffer ov…7.5
• CVE-2026-120209AJ-Report through 1.7.1 signs share tokens with a hard-coded…9.8
• CVE-2026-120210FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerabi…4.3
• CVE-2026-120213@fastify/http-proxy is a Fastify plugin that proxies HTTP re…9.1
• CVE-2026-120215@fastify/cors is the CORS plugin for the Fastify web framewo…3.7
• CVE-2026-120216fastify is a web framework for Node.js. In versions 5.8.0 th…5.9
• CVE-2026-120217A vulnerability was detected in Delgan loguru 0.7.3. The aff…4.3
• CVE-2026-120218A flaw has been found in Typemill up to 2.26.0. The impacted…3.5
• CVE-2026-12022Race in Safe Browsing in Google Chrome on Mac prior to 149.0…8.3
• CVE-2026-120222undici is an HTTP client for Node.js. In versions 7.0.0 thro…5.9