What is the CVSS score of CVE-2026-85124?

CVE-2026-85124 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Fastify Http Proxy are affected by CVE-2026-85124?

Fastify-http-proxy before version 11.6.2 contains a path traversal vulnerability allowing unauthenticated remote attackers to bypass configured access controls and access backend services intended to…. A patch is available.

How to fix or mitigate CVE-2026-85124?

Within 24 hours, inventory all deployments of @fastify/http-proxy and document their current versions. Within 7 days, upgrade all instances to version 11.6.2 or later, prioritizing systems proxying sensitive or internal-only backends. Within 30 days, review proxy access logs for evidence of path traversal attempts prior to upgrade, validate that upstream service boundaries are correctly enforced across both HTTP and WebSocket handlers, and confirm the fix prevents bypass attempts through backslash and dot-segment variants.

Fastify Http Proxy CVE-2026-85124

EUVD-2026-70381 HIGH

Path Traversal (CWE-22)

2026-09-03 openjs

Path Traversal Fastify Http Proxy

7.5

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (openjs) · only source for this CVE.

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

POC Analysis Generated

Sep 08, 2026 - 11:36 vuln.today

Patch available

Sep 03, 2026 - 12:01 EUVD

Analysis Generated

Sep 03, 2026 - 11:21 vuln.today

CVE Published

Sep 03, 2026 - 10:51 cve.org

HIGH 7.5

DescriptionCVE.org

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

AnalysisAI

Path traversal in @fastify/http-proxy before 11.6.2 permits unauthenticated remote attackers to bypass the prefix and rewritePrefix boundary controls and reach upstream paths that the proxy operator intended to keep hidden. The root cause is an asymmetry between the plain HTTP handler — which omits destination validation — and the WebSocket handler, which performs it correctly; the underlying reply-from library compounds this by only rejecting forward-slash traversal sequences, leaving backslash dot-segment variants unchecked. …