@fastify/http-proxy vulnerabilities
CVEs whose affected-version data names the @fastify/http-proxy package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-120214Medium· 5.9@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes th…
▾ Sunlit@fastify/http-proxy · @fastify/http-proxyEPSS 0.47%via CVEORG
CVE-2026-120213Critical· 9.1@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients …
▾ Midnight@fastify/http-proxy · @fastify/http-proxyEPSS 0.69%via CVEORG