Fastify Http Proxy

Proxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated attackers reach upstream endpoints the proxy was configured to hide. Because Fastify's router URL-decodes paths for route matching while the rewrite step performs a literal string replace against the decoded prefix, a request that URL-encodes any character of the configured prefix still matches the route but skips the rewrite, forwarding the raw encoded path to the upstream, which decodes and serves it. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score is 10.0 (scope-changed) and the OpenJS/GHSA advisory characterizes it as an information-disclosure access-control bypass.

We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules. First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page. We need to produce each field according to the instructions. product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the

HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.