CVE-2026-15631

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

• CWE-22

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-7hrw-592w-9wh2Vendor Advisory

Published

Jul 18, 2026

Last Modified

Jul 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15626A vulnerability was determined in nextlevelbuilder GoClaw 3.…6.3
• CVE-2026-15627A vulnerability was identified in nextlevelbuilder GoClaw up…4.3
• CVE-2026-15628A security flaw has been discovered in zhayujie chatgpt-on-w…6.3
• CVE-2026-15629A weakness has been identified in louisho5 picobot up to 0.2…6.3
• CVE-2026-1563Pega Platform versions 8.1.0 through 25.1.2 are affected by …4.8
• CVE-2026-15630A non-global organization admin in one tenant can bypass ten…9.9
• CVE-2026-15637Improper authorization in the PAM SSH key and certificate re…7.5
• CVE-2026-1564Pega Platform versions 8.1.0 through 25.1.1 are affected by …4.8
• CVE-2026-15641Improper authorization in the access request status endpoint…7.1
• CVE-2026-15642Insertion of sensitive information into a file in the Recove…3.3
• CVE-2026-15643AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is…9.2
• CVE-2026-15644The Powerkit – Supercharge your WordPress Site plugin for Wo…6.4