CVE-2026-85124

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85124
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85124.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85124
Aliases
  • GHSA-qv33-689p-2xq5
Published
2026-09-03T10:51:24Z
Modified
2026-09-11T03:48:22Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
Details

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85124.json"
}
References

Affected packages

Git / github.com/fastify/fastify-http-proxy

Affected ranges

Type
GIT
Repo
https://github.com/fastify/fastify-http-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
00b5a39b365c2b28a86a97a4e57445442e2f0eb6
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:fastify:fastify\\/http-proxy:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.6.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.1.1
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.6.0
v0.7.0
v0.8.0
v1.*
v1.0.0
v10.*
v10.0.0
v10.0.1
v10.0.2
v11.*
v11.0.0
v11.0.1
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.4.0
v11.4.1
v11.4.2
v11.4.3
v11.4.4
v11.5.0
v11.6.0
v11.6.1
v2.*
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.2.0
v2.3.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v5.*
v5.0.0
v6.*
v6.0.0
v6.0.1
v6.1.0
v6.2.0
v6.2.1
v6.2.2
v7.*
v7.0.0
v7.1.0
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.1.0
v8.2.0
v8.2.1
v8.2.2
v8.2.3
v8.3.0
v8.4.0
v9.*
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.4.0
v9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85124.json"