CVE-2026-85124

Versions of @fastify/http-proxy before 11.6.2 fail to validate proxied HTTP request paths for backslash-based dot-segments before forwarding them to the configured upstream. Because the plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, an unauthenticated network attacker can send requests containing backslash dot-segments that escape the boundary enforced by the prefix and rewritePrefix options. This lets the attacker reach upstream paths that were intended to remain hidden behind the proxy, resulting in disclosure of internal endpoints. Any application using @fastify/http-proxy below 11.6.2 is affected. Exploitation has not been reported publicly: there is no known proof of concept, the issue is not in CISA KEV, and EPSS currently estimates only a 0.6% chance of exploitation in the next 30 days.

What to do: Upgrade to @fastify/http-proxy 11.6.2 or later. If you cannot upgrade immediately, review your prefix/rewritePrefix configuration for upstream paths that should stay hidden, and consider rejecting incoming proxied request paths containing backslashes or dot-segments at an upstream control such as a reverse proxy or WAF. Check access logs for unusual requests with backslash sequences in the path targeting your proxy endpoints.