fastify/http-proxy vulnerabilities

CVEs whose affected-version data names the fastify/http-proxy package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-85124High· 7.5

2w ago

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation tha…

▾ Twilightfastify · fastify/http-proxyEPSS 0.55%via NVD