VulnSea

@fastify/http-proxy has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.5 (high), with 1 rated critical.

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
2 prev 0

Weakness classes

Products

  • @fastify/http-proxy 2
Follow @fastify/http-proxy:RSS feedSave a search →Embed badge ↗
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

@fastify/http-proxy vulnerabilities

CVEs affecting @fastify/http-proxy, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-120214Medium· 5.9
6d ago

@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes th…

▾ Sunlit@fastify/http-proxy · @fastify/http-proxyEPSS 0.47%via CVEORG
CVE-2026-120213Critical· 9.1
6d ago

@fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients …

▾ Midnight@fastify/http-proxy · @fastify/http-proxyEPSS 0.69%via CVEORG
@fastify/http-proxy vulnerabilities (CVEs) · VulnSea