We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules. First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page. We need to produce each field according to the instructions. product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the
Proxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated attackers reach upstream endpoints the proxy was configured to hide. Because Fastify's router URL-decodes paths for route matching while the rewrite step performs a literal string replace against the decoded prefix, a request that URL-encodes any character of the configured prefix still matches the route but skips the rewrite, forwarding the raw encoded path to the upstream, which decodes and serves it. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score is 10.0 (scope-changed) and the OpenJS/GHSA advisory characterizes it as an information-disclosure access-control bypass.
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authenticated OWNER or EDITOR user embed malicious SurrealQL inside unescaped table or field names that executes when a higher-privileged operator re-imports the CLI-exported backup, yielding root-level takeover of the instance. Reported by VulnCheck and discovered during a cure53 audit, it also enables a universal second-order injection against co-tenanted applications that let end users define custom tables or fields, even when query parameters are otherwise sanitized. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor and cure53 both rate the impact Critical (CVSS 4.0 base 9.4).
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.