L3 · ShartedNode.js · Fastify · SSRFfastify-http-proxy-prefix-escape

Fastify HTTP proxy lets decoded route parameters escape enforced upstream paths

@fastify/http-proxy 9.0.0 through 11.6.5 can let unauthenticated requests escape a fixed upstream path when parameterized prefix and rewritePrefix enforce path limits. Depending on the upstream, this enables SSRF or authorization bypass. Upgrade to 11.6.6; the advisory lists no workaround.

Disclosed: Nov 2, 2026; Public disclosure date
Severity: CVSS 9.1; 1 CVE tracked here
Splash zone: Apps using @fastify/http-proxy 9.0.0–11.6.5 with parameterized prefix/rewritePrefix as upstream path restrictions; npm · node
In the wild: Unknown; The maintainer advisory does not report real-world exploitation.

What happened

The proxy inserts URL-decoded route parameters into rewritePrefix without re-encoding them. A decoded slash together with a fragment or query delimiter can add path segments and discard the required suffix without using parent-directory traversal. The attack needs a reachable vulnerable proxy configuration; the resulting access depends on the upstream’s own authorization. This is not a general compromise of Fastify or all proxy deployments.

GHSA-h3vp-4jfr-v364 identifies the affected range and patch. The public advisory includes request examples, but does not confirm exploitation or publish a victim count.

What’s in the bowl

CVE-2026-120213CVSS 9.1

Decoded-parameter prefix escape

Decoded path separators and query/fragment delimiters alter the upstream path and remove its enforced suffix.

Fixed versions

Product	Safe from	Note
@fastify/http-proxy	`11.6.6`	Patched; affected range >=9.0.0, <11.6.6

Crime-scene timeline

Nov 2, 2026
Maintainers publish the advisory and identify 11.6.6 as patched

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Fastify maintainer advisory GHSA-h3vp-4jfr-v364Primary

Wipe guide

The wipe checklist

0 of 3 sheets used

Find affected proxy configurationsCheck deployed dependency versions and lockfiles, then find @fastify/http-proxy registrations using parameters in prefix and rewritePrefix to limit upstream paths. Exposure depends on this use of path restrictions, not just on installing Fastify.
Upgrade and redeploy every affected serviceUse @fastify/http-proxy 11.6.6 or later, regenerate the lockfile through your normal dependency process and verify the version in the deployed service. The maintainer lists no workaround; do not treat a proxy restart alone as a fix.
Verify boundaries and investigate unexpected pathsIn your own test environment, confirm encoded separators and query/fragment delimiters cannot remove the intended upstream suffix. Review proxy and upstream logs for access outside allowed paths, and investigate unauthorized data access or changes. Such requests alone do not prove successful compromise.