@fastify/http-proxy CVE-2026-16117

The affected component is @fastify/http-proxy, a Fastify plugin that reverse-proxies incoming requests to an upstream, typically using the prefix/rewritePrefix options to expose an internal service under a public path while stripping or rewriting that path segment before forwarding. The root cause is CWE-20 (Improper Input Validation): two different representations of the request path are used inconsistently. Fastify's router normalizes and URL-decodes the incoming path for route matching, so an encoded prefix such as /admi%6e still matches the configured route, but request.url retains the original percent-encoded form. The plugin's prefix-rewrite logic uses a plain literal string replacement against the decoded prefix value; when the incoming URL is encoded it does not textually match, the replacement silently no-ops, and the untouched encoded path is forwarded upstream. The upstream server then performs its own URL-decoding and serves the fully-decoded path, defeating the segment-hiding that rewritePrefix was intended to enforce. The CPE cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:* identifies the plugin itself as the affected product across all versions prior to the fix.