Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 2 total.
Library:
fastify_http_proxy
CVE-2026-16117
CRITICAL
CVSS 10.0
Verified Advisory
Jul 18, 2026
Path restriction bypass in @fastify/http-proxy (CVE-2026-16117)
@fastify/http-proxy fails to rewrite the request prefix when percent-encoded characters are used in the prefix portion of the URL. Because Fastify's router URL-decodes paths for route matching while request.url retain...
Fixed in 11.6.0
Information Disclosure
Fastify Http Proxy
CVE-2026-15631
HIGH
CVSS 8.7
Verified Advisory
Jul 18, 2026
Path traversal in @fastify/http-proxy WebSocket upstream routing (CVE-2026-15631)
@fastify/http-proxy fails to validate the resolved WebSocket destination path against the configured rewrite prefix, because the WebSocket upstream target is built with the WHATWG URL constructor, which performs RFC-3...
Fixed in >= 11.6.0
Path Traversal
Fastify Http Proxy