@fastify/http-proxy EUVD-2026-115115

Exploitation requires the target to run @fastify/http-proxy 11.6.0-11.6.2 configured with a prefix/rewritePrefix pair used to isolate (hide) part of an upstream's URL space behind the public proxy, AND an upstream server that percent-decodes %5C and treats the resulting backslash as a path separator (the advisory names a Windows host serving static files as the canonical case). The attacker needs no authentication and no user interaction, and crafts a request using percent-encoded backslash dot-segments (e.g. /pub/%5C..%5Csecret). The decisive limiting factor is the upstream's path handling: on an upstream that does not treat decoded backslashes as separators (typical POSIX path resolution), the forwarded request does not escape the prefix, which is why CVSS assigns AC:H. The flaw is also moot where prefix/rewritePrefix is not relied upon as a confidentiality boundary.

This is a genuine but conditional, moderate-priority issue rather than a drop-everything emergency, and the signals are internally consistent. The supplied CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) correctly reflects a network-reachable, unauthenticated flaw with no integrity or availability impact and high attack complexity, because exploitation does not succeed against the proxy alone - it depends on the upstream server decoding %5C and treating a backslash as a path separator (per the advisory, e.g. a Windows host serving static files). The vuln.today Decision label is 'this_month', not act_now/emergency, which aligns with a confidentiality-only path-restriction bypass that is contingent on upstream behavior. No KEV listing and no EPSS score were provided, so widespread active exploitation is not indicated; absence of those signals is not evidence of safety but does not elevate urgency here. The confidentiality impact is rated C:H in the input, which is defensible when rewritePrefix is the only boundary isolating sensitive upstream paths, but real-world severity hinges entirely on (a) whether the upstream treats backslash as a separator and (b) what sibling resources sit outside the configured prefix - verify both against your actual deployment before concluding C:H applies to you.

An application exposes @fastify/http-proxy publicly with prefix '/pub' and rewritePrefix '/internal' to isolate part of a Windows-based upstream's URL space. An unauthenticated remote attacker sends GET /pub/%5C..%5Csecret; the encoded backslash dot-segments pass validateDestination() and are forwarded intact, and the upstream decodes %5C, treats it as a path separator, and returns the sibling resource /secret that the prefix was meant to hide. No public working exploit code is identified at time of analysis, though the advisory documents the exact request form.