EUVD-2026-45375Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Network and unauthenticated (AV:N/PR:N), but AC:H because a non-normalizing client is required; S:C as the proxy reaches a separate upstream, exposing/altering internal endpoints (C:H/I:H), with no availability impact.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies.
Patches: upgrade to @fastify/http-proxy 11.6.0.
Workarounds: none.
AnalysisAI
Path-traversal bypass in @fastify/http-proxy (versions 9.4.0 through 11.5.0) lets remote, unauthenticated attackers escape the configured WebSocket rewrite prefix and reach upstream endpoints the proxy was never meant to expose. The flaw lives in WebSocketProxy.findUpstream, which resolves the destination through the WHATWG URL constructor that silently collapses dot-segments, so a crafted WebSocket upgrade request carrying '../' sequences routes past the intended prefix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that @fastify/http-proxy (9.4.0-11.5.0) be configured to proxy WebSocket traffic behind a rewrite prefix, and that the attacker deliver a WebSocket upgrade request whose path contains '../' path-traversal sequences. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N scores 8.7 (High): network reachable and unauthenticated (PR:N), with a changed scope (S:C) reflecting that the proxy is abused to reach a separate upstream security authority, and High confidentiality and integrity impact from exposing internal endpoints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker uses a raw HTTP or WebSocket client that does not normalize paths to send an upgrade request to the proxy's public WebSocket route with '../' traversal sequences embedded in the path. The WHATWG URL constructor collapses the dot-segments during resolution, so the request escapes the configured rewrite prefix and is proxied to an internal upstream endpoint that was never meant to be exposed, exposing or manipulating backend functionality. … |
| Remediation | Vendor-released patch: @fastify/http-proxy 11.6.0 - upgrade to this version or later, which is the primary and only complete fix since the vendor lists no workarounds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications using @fastify/http-proxy versions 9.4.0-11.5.0, enumerate configured WebSocket endpoints, and document exposed upstream backend services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fastify Http Proxy
View allProxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated att
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with h
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today