EUVD-2026-45379Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Remote unauthenticated encoding trick (AV:N/AC:L/PR:N/UI:N) bypasses the proxy to a separate upstream (S:C); confidentiality High via exposed endpoints, integrity only Low since state change depends on which upstream endpoints are reachable.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.
Patches: upgrade to @fastify/http-proxy 11.6.0.
Workarounds: none.
AnalysisAI
Proxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated attackers reach upstream endpoints the proxy was configured to hide. Because Fastify's router URL-decodes paths for route matching while the rewrite step performs a literal string replace against the decoded prefix, a request that URL-encodes any character of the configured prefix still matches the route but skips the rewrite, forwarding the raw encoded path to the upstream, which decodes and serves it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses @fastify/http-proxy (<= 11.5.0) configured with a prefix and rewritePrefix where that rewrite is relied upon to hide or remap upstream paths, and that the upstream service decodes and serves the forwarded encoded path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuinely high real-world severity, with one nuance about what the impact actually is. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who knows or guesses that an internal service sits behind the proxy sends a normal-looking HTTP request in which one character of the hidden prefix is percent-encoded (for example encoding a letter of /admin). The request matches the proxy route but skips the rewrite, so the encoded path is forwarded verbatim; the upstream decodes it and serves the administrative or internal endpoint the proxy was meant to hide. … |
| Remediation | Vendor-released patch: upgrade @fastify/http-proxy to 11.6.0 or later, which corrects the prefix-rewrite logic so encoded prefixes are handled consistently; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running @fastify/http-proxy versions ≤11.5.0 and immediately block direct network access to upstream endpoints to only explicitly authorized internal services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fastify Http Proxy
View allfastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with h
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
Path-traversal bypass in @fastify/http-proxy (versions 9.4.0 through 11.5.0) lets remote, unauthenticated attackers esca
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today