CVE-2026-120214
Received Received - Intake

Path Traversal in Fastify HTTP Proxy

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: openjs

Description
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
@fastify/http-proxy @fastify/http-proxy 11.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @fastify/http-proxy package versions 11.6.0 through 11.6.2. It allows path traversal via percent-encoded backslashes (%5C..%5C) that bypass the prefix boundary check. The issue occurs because the package normalizes literal backslashes before percent-decoding, enabling attackers to craft requests that resolve to sibling resources on the upstream server if it treats backslashes as path separators.

Detection Guidance

To detect this vulnerability, inspect your network traffic for requests targeting @fastify/http-proxy with encoded backslashes in paths, such as GET /pub/%5C..%5Csecret. Check if upstream servers interpret backslashes as path separators. Use tools like Wireshark or tcpdump to capture and analyze HTTP requests for suspicious patterns.

Impact Analysis

An unauthenticated remote attacker could exploit this to access restricted resources outside the intended proxy prefix, potentially leading to unauthorized data exposure. The impact depends on the upstream server's path handling, specifically if it interprets backslashes as separators.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of restricted resources may result in non-compliance with data protection regulations.

Mitigation Strategies

Immediately upgrade @fastify/http-proxy to version 11.6.3 or later. If upgrading is not possible, restrict access to the proxy or disable it until patched. Monitor upstream servers for unauthorized access attempts and review access logs for suspicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...