EUVD-2026-70381Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Path traversal in @fastify/http-proxy before 11.6.2 permits unauthenticated remote attackers to bypass the prefix and rewritePrefix boundary controls and reach upstream paths that the proxy operator intended to keep hidden. The root cause is an asymmetry between the plain HTTP handler — which omits destination validation — and the WebSocket handler, which performs it correctly; the underlying reply-from library compounds this by only rejecting forward-slash traversal sequences, leaving backslash dot-segment variants unchecked. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fastify Http Proxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
Technical POC Analysis
Bug class: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Fastify-http-proxy before version 11.6.2 contains a path traversal vulnerability allowing unauthenticated remote attackers to bypass configured access controls and access backend services intended to remain hidden from external exposure. Organizations operating this library as a reverse proxy face unauthorized access to sensitive upstream systems and confidential data. Immediate upgrade is essential to restore intended security boundaries.
Within 24 hours, inventory all deployments of @fastify/http-proxy and document their current versions. Within 7 days, upgrade all instances to version 11.6.2 or later, prioritizing systems proxying sensitive or internal-only backends. Within 30 days, review proxy access logs for evidence of path traversal attempts prior to upgrade, validate that upstream service boundaries are correctly enforced across both HTTP and WebSocket handlers, and confirm the fix prevents bypass attempts through backslash and dot-segment variants.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Fastify Http Proxy
View allWe are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The
Proxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated att
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with h
Path-restriction bypass in @fastify/http-proxy 9.0.0 through 11.6.5 lets unauthenticated remote attackers escape an inte
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attac
@fastify/http-proxy 11.6.0 through 11.6.2 lets an unauthenticated remote attacker reach upstream resources outside the i
Exploit-DB