@fastify/http-proxy CVE-2026-16117

Exploitation requires that the target application uses @fastify/http-proxy (<= 11.5.0) configured with a prefix and rewritePrefix where that rewrite is relied upon to hide or remap upstream paths, and that the upstream service decodes and serves the forwarded encoded path. The concrete trigger is a request that URL-encodes one or more characters of the configured prefix segment, which matches Fastify's decoded route but bypasses the literal-string rewrite. Limiting factors: the value of the attack depends on what sensitive endpoints exist on the upstream behind the hidden prefix - if the upstream independently authenticates those endpoints, the bypass yields reachability but not necessarily data or actions. No user interaction, no authentication, and no non-default plugin configuration beyond ordinary prefix/rewritePrefix usage are needed, making default proxy-hiding deployments remotely exploitable.

All available signals point to genuinely high real-world severity, with one nuance about what the impact actually is. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N yields the maximum 10.0, driven by remote, low-complexity, unauthenticated exploitation and a scope change reflecting that the proxy is abused to compromise a separate upstream security authority. However, EPSS and CISA KEV data were not provided in the input, so exploitation probability and active-exploitation status are unknown, and no public exploit was identified at time of analysis - meaning the 10.0 reflects intrinsic exploitability and blast radius, not observed exploitation. There is a modeling tension worth flagging: the advisory tags this as Information Disclosure and the described mechanism is fundamentally an access-control/path bypass, so the confidentiality impact (C:H) is well-supported, while the base score's integrity impact (I:H) is conditional on which upstream endpoints become reachable - it is fully justified only when the exposed internal/administrative endpoints themselves permit state-changing operations. No SSVC decision data was supplied. Net assessment: a real priority for any deployment that relies on rewritePrefix as a security boundary in front of sensitive upstreams, but teams whose upstream endpoints are read-only or independently authenticated face primarily disclosure rather than full compromise.

An attacker who knows or guesses that an internal service sits behind the proxy sends a normal-looking HTTP request in which one character of the hidden prefix is percent-encoded (for example encoding a letter of /admin). The request matches the proxy route but skips the rewrite, so the encoded path is forwarded verbatim; the upstream decodes it and serves the administrative or internal endpoint the proxy was meant to hide. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), and no public exploit is needed since the technique is a simple encoding trick.