EUVD-2026-45375Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 28, 2026
We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules.
First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page.
We need to produce each field according to the instructions.
product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the
Earlier versions of this analysis (1)
Path-traversal bypass in @fastify/http-proxy (versions 9.4.0 through 11.5.0) lets remote, unauthenticated attackers escape the configured WebSocket rewrite prefix and reach upstream endpoints the proxy was never meant to expose. The flaw lives in WebSocketProxy.findUpstream, which resolves the destination through the WHATWG URL constructor that silently collapses dot-segments, so a crafted WebSocket upgrade request carrying '../' sequences routes past the intended prefix. There is no public exploit identified at time of analysis; exploitation is gated by the need for a non-normalizing WebSocket client, and no EPSS or CISA KEV signal is present in the supplied data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fastify Http Proxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network and unauthenticated (AV:N/PR:N), but AC:H because a non-normalizing client is required; S:C as the proxy reaches a separate upstream, exposing/altering internal endpoints (C:H/I:H), with no availability impact.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies.
Patches: upgrade to @fastify/http-proxy 11.6.0.
Workarounds: none.
Executive ViewAI
A critical flaw in @fastify/http-proxy (versions 9.4.0-11.5.0) enables unauthenticated remote attackers to bypass proxy-enforced access controls and reach internal backend services. Although no public exploit code is currently known, the vulnerability directly undermines the proxy's core security function of isolating internal systems. Organizations must immediately assess and protect against potential exploitation of this access control bypass.
Within 24 hours, identify all applications using @fastify/http-proxy versions 9.4.0-11.5.0, enumerate configured WebSocket endpoints, and document exposed upstream backend services. Within 7 days, implement network-level WebSocket traffic restrictions, deploy Web Application Firewall (WAF) rules to reject requests containing path-traversal patterns ('../' and similar), and disable WebSocket proxying functionality if operationally feasible. Within 30 days, downgrade to versions prior to 9.4.0, monitor the @fastify/http-proxy project for security patch releases and apply immediately upon availability, or migrate to alternative proxy solutions with confirmed security posture.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-layer or WAF-level restrictions on WebSocket traffic; (2) deploy input validation rules to reject requests with path-traversal sequences; (3) maintain explicit allow-list of permitted upstream backend destinations; (4) downgrade to versions prior to 9.4.0 if operationally feasible; (5) disable WebSocket proxying if business requirements permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Fastify Http Proxy
View allProxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated att
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with h
Path-restriction bypass in @fastify/http-proxy 9.0.0 through 11.6.5 lets unauthenticated remote attackers escape an inte
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
Path traversal in @fastify/http-proxy before 11.6.2 permits unauthenticated remote attackers to bypass the prefix and re
@fastify/http-proxy 11.6.0 through 11.6.2 lets an unauthenticated remote attacker reach upstream resources outside the i
Exploit-DB