---
id: CVE-2026-85124
title: >-
  @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP
  request paths for backslash based dot-segments before forwarding them to the
  configured upstream
summary: >-
  @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP
  request paths for backslash based dot-segments before forwarding them to the
  configured upstream. The plain HTTP request handler skips the destination
  validation tha…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: fastify
product: fastify/http-proxy
affected:
  - fastify/http-proxy < 11.6.2
patched:
  - fastify/http-proxy 11.6.2
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T19:25:40.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85124'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85124.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85124'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527955'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-85124'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85124'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00552
epssPercentile: 0.45006
ingestedAt: '2026-09-09T20:21:14.799Z'
---

## Overview

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

## Affected

- `fastify/http-proxy < 11.6.2`

## Remediation

Upgrade past the affected range:

- `fastify/http-proxy 11.6.2`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85124.json)