CVE-2026-16117

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

• CWE-20

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-mx7v-qhg9-2mvvVendor Advisory

Published

Jul 18, 2026

Last Modified

Jul 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16104A flaw was found in the authentication configuration endpoin…4.3
• CVE-2026-16105A flaw was found in the RoleContainerResource component of K…4.9
• CVE-2026-16106A flaw was found in the admin REST API of Keycloak, a soluti…4.9
• CVE-2026-16107IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does …5.9
• CVE-2026-16108A flaw was found in the default-groups REST endpoint and rea…4.3
• CVE-2026-1611The Wikiloops Track Player plugin for WordPress is vulnerabl…6.4
• CVE-2026-16118A flaw was found in xdgmime. A heap-based buffer overflow ca…7.1
• CVE-2026-16119A vulnerability was found in nextlevelbuilder GoClaw up to 3…6.3
• CVE-2026-1612AL-KO Robolinho Update Software has hard-coded AWS Access an…6.9
• CVE-2026-16120A vulnerability was determined in nextlevelbuilder GoClaw up…6.3
• CVE-2026-16121A vulnerability was identified in nextlevelbuilder GoClaw up…6.3
• CVE-2026-16122A security flaw has been discovered in nextlevelbuilder GoCl…4.3