Path Traversal in Fastify HTTP Proxy

Executive Summary

This vulnerability affects @fastify/http-proxy versions before 11.6.2. It allows unauthenticated attackers to use backslash dot-segments in HTTP request paths to bypass path validation and access internal endpoints that should be hidden behind the proxy. The issue occurs because the plain HTTP request handler skips destination validation that the WebSocket path performs, and the underlying library only blocks forward-slash traversal.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your network traffic for HTTP requests containing backslash dot-segments (e.g., %5C..%5C) in paths forwarded by @fastify/http-proxy versions before 11.6.2. Check proxy logs for unusual requests reaching internal endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive internal endpoints, potentially exposing confidential data or internal services. This could lead to unauthorized information disclosure, data breaches, or further network compromise depending on the exposed endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @fastify/http-proxy to version 11.6.2 or later immediately. Review proxy configurations to ensure prefix and rewritePrefix options are correctly restricting access to internal paths.

Useful 0 Not Useful 0