fastify-http-proxy EUVD-2026-115117

Exploitation requires the proxy application to be configured with BOTH a parameterized prefix and a parameterized rewritePrefix that substitute a route parameter to pin clients to a fixed upstream path (e.g. prefix '/tenants/:tenantId/public-avatar', rewritePrefix '/:tenantId/public-avatar'); deployments that do not use parameterized rewritePrefix are not affected. The attacker needs no authentication and no user interaction, and crafts a parameter value that percent-encodes a path separator (%2f) together with a fragment (%23) or query (%3f) delimiter. Realistic impact is bounded by what the upstream exposes behind the proxy - the bypass reaches upstream paths outside the intended prefix, so authorization-bypass or SSRF severity depends on the specific upstream service. The only limiting factor is the required vulnerable configuration; there is no workaround other than upgrading to 11.6.6.

The vendor (OpenJS) CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact, which is internally consistent with the description of an unauthenticated prefix-escape. The vuln.today Decision label is act_now, reinforcing high urgency. However, the raw CVSS overstates the universal real-world risk because exploitation is conditional: only deployments that use parameterized prefix AND rewritePrefix to pin clients to a fixed upstream path are vulnerable - this is a specific, non-default proxy configuration, so the population of actually-exploitable installs is a subset of all @fastify/http-proxy users. No EPSS score and no KEV status were provided in the input, so there is no signal of observed in-the-wild exploitation or a quantified exploitation probability - treat the act_now label as a priority recommendation rather than evidence of active exploitation. The GHSA advisory includes concrete worked example requests demonstrating the bypass, so a public PoC reference exists even though it is not supplied as a verified standalone working exploit. Net: this is a genuine high priority for teams running the vulnerable configuration behind a public proxy, but a lower practical risk for deployments that do not use parameterized rewritePrefix.

An application fronts an internal service with @fastify/http-proxy configured as prefix '/tenants/:tenantId/public-avatar' and rewritePrefix '/:tenantId/public-avatar' to confine clients to a public avatar path. An unauthenticated remote attacker sends GET /tenants/admin%2fmaster-keys%23/public-avatar; the plugin URL-decodes the parameter, the %2f becomes a real '/' and %23 becomes '#', injecting extra path segments and stripping the mandatory '/public-avatar' suffix so the proxy forwards GET /admin/master-keys to the upstream. The advisory provides these exact example requests as a public PoC reference (not verified as packaged working exploit code).