---
id: CVE-2026-120214
title: >-
  @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash
  dot-segments
summary: >-
  @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an
  upstream server under a configured prefix. In versions 11.6.0 through 11.6.2,
  the destination validation normalizes literal backslashes before it
  percent-decodes th…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: '@fastify/http-proxy'
product: '@fastify/http-proxy'
affected:
  - '@fastify/http-proxy >= 11.6.0 < 11.6.3'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:09:16.614243Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:09:29.705Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120214'
references:
  - url: >-
      https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv
  - url: 'https://cna.openjsf.org/security-advisories.html'
tags:
  - cve.org
epss: 0.00475
epssPercentile: 0.41324
ingestedAt: '2026-11-05T19:30:42.720Z'
---

## Overview

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.

## Affected

- `@fastify/http-proxy >= 11.6.0 < 11.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.