Path traversal in @fastify/http-proxy WebSocket upstream routing (CVE-2026-15631)

@fastify/http-proxy fails to validate the resolved WebSocket destination path against the configured rewrite prefix, because the WebSocket upstream target is built with the WHATWG URL constructor, which performs RFC-3986 path resolution and collapses dot segments. A crafted WebSocket upgrade request containing path traversal sequences can escape the rewritePrefix subtree and reach arbitrary upstream WebSocket endpoints the proxy was configured to hide, enabling authorization bypass, SSRF-style reach, and data exfiltration. This is a WebSocket-transport variant of CVE-2021-21322, which was previously fixed only for the HTTP code path. Affected versions: - >= 9.4.0, <= 11.5.0 We recommend updating to: >= 11.6.0. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-7hrw-592w-9wh2 Details: https://vuln.today/cve/CVE-2026-15631