Path restriction bypass in @fastify/http-proxy (CVE-2026-16117)

@fastify/http-proxy fails to rewrite the request prefix when percent-encoded characters are used in the prefix portion of the URL. Because Fastify's router URL-decodes paths for route matching while request.url retains the encoded form, the literal string replace against the decoded prefix is skipped, causing the raw encoded path to be forwarded to the upstream unchanged. This allows an unauthenticated remote attacker to bypass path restrictions imposed by rewritePrefix, potentially reaching internal upstream paths and enabling SSRF or authorization bypass in the proxied service. Affected versions: - <= 11.5.0 We recommend updating to: 11.6.0. CVSS 10.0 · our assessment: act_now Vendor advisory: https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-mx7v-qhg9-2mvv Details: https://vuln.today/cve/CVE-2026-16117