CVE-2026-120213
Received Received - Intake

Path Restriction Bypass in Fastify HTTP Proxy

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: openjs

Description
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120213

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
@fastify/http-proxy @fastify/http-proxy 9.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @fastify/http-proxy package versions 9.0.0 to 11.6.5. It occurs when URL-decoded route parameters are substituted into the rewritePrefix without proper re-encoding. Attackers can manipulate path segments by injecting encoded characters like '/' or '#' within parameters, bypassing intended path restrictions.

Detection Guidance

Check if your system uses @fastify/http-proxy versions 9.0.0 through 11.6.5. Run: npm list @fastify/http-proxy. If the version is within this range, the system is vulnerable.

Impact Analysis

An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix. This may lead to path-restriction bypass, Server-Side Request Forgery (SSRF), or authorization bypass in the proxied service, depending on the upstream configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or systems, which may violate compliance requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., unauthorized disclosure of protected health information). The path-restriction bypass and potential SSRF or authorization bypass could expose protected data to attackers.

Mitigation Strategies

Upgrade @fastify/http-proxy to version 11.6.6 or later immediately. Use: npm update @fastify/http-proxy. No workarounds exist; upgrading is the only solution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...