What is the CVSS score of CVE-2026-15631?

CVE-2026-15631 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Fastify Http Proxy are affected by CVE-2026-15631?

A critical flaw in @fastify/http-proxy (versions 9.4.0-11.5.0) enables unauthenticated remote attackers to bypass proxy-enforced access controls and reach internal backend services.. A patch is available.

How to fix or mitigate CVE-2026-15631?

Within 24 hours, identify all applications using @fastify/http-proxy versions 9.4.0-11.5.0, enumerate configured WebSocket endpoints, and document exposed upstream backend services. Within 7 days, implement network-level WebSocket traffic restrictions, deploy Web Application Firewall (WAF) rules to reject requests containing path-traversal patterns ('../' and similar), and disable WebSocket proxying functionality if operationally feasible. Within 30 days, downgrade to versions prior to 9.4.0, monitor the @fastify/http-proxy project for security patch releases and apply immediately upon availability, or migrate to alternative proxy solutions with confirmed security posture.

Fastify Http Proxy CVE-2026-15631

EUVD-2026-45375 CRITICAL

Path Traversal (CWE-22)

2026-07-18 openjs

Path Traversal Fastify Http Proxy

10.0

CVSS 3.1 · NVD

Severity by source

Vendor (openjs) PRIMARY

HIGH

qualitative

NVD

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network and unauthenticated (AV:N/PR:N), but AC:H because a non-normalizing client is required; S:C as the proxy reaches a separate upstream, exposing/altering internal endpoints (C:H/I:H), with no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 28, 2026 - 15:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 28, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jul 28, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Jul 28, 2026 - 15:52 NVD

8.7 (HIGH) 10.0 (CRITICAL)

Patch available

Jul 18, 2026 - 15:17 EUVD

Analysis Generated

Jul 18, 2026 - 13:31 vuln.today

CVE Published

Jul 18, 2026 - 12:46 cve.org

HIGH 8.7

DescriptionNVD

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies.

Patches: upgrade to @fastify/http-proxy 11.6.0.

Workarounds: none.

AnalysisAI

We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules.

First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page.

We need to produce each field according to the instructions.

product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the