Path traversal in Fastify-http-proxy - CVE-2026-120213
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass upstream path restrictions and potentially access or modify protected resources in the proxied service.
The vulnerability exists due to failure to re-encode URL-decoded route parameters in the rewritePrefix handling of @fastify/http-proxy when processing requests with parameterized prefix and rewritePrefix options. A remote attacker can supply an encoded slash combined with an encoded fragment or query delimiter to inject upstream path segments and discard a mandatory suffix, potentially bypassing authorization or enabling server-side request forgery depending on the upstream service. For example, with prefix: '/tenants/:tenantId/public-avatar' and rewritePrefix: '/:tenantId/public-avatar', /tenants/admin%2fmaster-keys%23/public-avatar forwards GET /admin/master-keys, while /tenants/admin%2fusers%3ftruncate=/public-avatar forwards GET /admin/users.