Description

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T13:06:21.773Z",
  "pubdate": "2026-09-03T13:06:21.773Z",
  "executiveSummary": "@fastify/http-proxy versions prior to 11.6.2 are susceptible to a path traversal vulnerability (CWE-22) resulting from insufficient input validation of proxied HTTP request paths.\nThe vulnerability allows an unauthenticated, remote attacker to bypass intended boundary restrictions defined by the proxy configuration, such as 'prefix' and 'rewritePrefix' options.\nBy injecting backslash-based dot-segments into the request path, an attacker can escape the proxy scope and access arbitrary internal endpoints on the upstream server that were intended to be restricted or hidden.\nThis represents a significant security risk, potentially leading to the unauthorized disclosure of sensitive internal information, exposure of administrative APIs, or access to restricted internal services.\nExploitation does not require authentication and can be performed over the network by crafting malicious HTTP requests. Users are strongly advised to upgrade to version 11.6.2 or later to address this flaw.",
  "technicalDetails": "The vulnerability originates from a deficiency in path normalization and validation logic within @fastify/http-proxy. While the library implements validation for WebSocket paths, the primary HTTP request handler fails to enforce similar security constraints on the request path before forwarding it to the configured upstream server.\nThe root cause is identified as an incomplete implementation of traversal protection within the underlying 'reply-from' library. The library's validation logic explicitly checks for forward-slash (/) based path traversal attempts but fails to account for backslash (\\) character sequences used to represent directory traversal or dot-segments in certain URI parsing contexts. Because the proxy mechanism does not sanitize the path input to normalize these backslash-based segments, it fails to identify attempts to traverse outside of the designated 'prefix' or 'rewritePrefix' paths.\nAn attacker can exploit this flaw by submitting an HTTP request where the path component contains backslash-encoded dot-segments (e.g., '..\\..\\'). Upon receiving the request, the proxy component evaluates the path; because the current validation logic only monitors for forward-slash sequences, the malicious path is permitted and passed directly to the 'reply-from' module. The upstream server, which may be more permissive or interpret backslashes as valid directory separators depending on its environment and implementation, processes the malformed path.\nThe attack flow follows these steps: 1) The attacker identifies a target endpoint protected by the @fastify/http-proxy; 2) The attacker crafts a request URI containing backslash-based dot-segments, such as 'GET /proxied-path/..\\..\\internal-endpoint'; 3) The proxy fails to validate or sanitize the backslashes, effectively bypassing the path prefix enforcement; 4) The proxy forwards the raw, unvalidated path to the upstream service; 5) The upstream service interprets the traversal sequence, allowing the request to be routed to an unintended internal resource that exists outside the proxy's intended routing boundary. This results in the disclosure of internal information or unauthorized interaction with internal APIs.\nThis issue is present in all versions of @fastify/http-proxy prior to 11.6.2. The vulnerability is highly exploitable as it requires no privileges or prior authentication, and the attack surface is exposed via any network-facing proxy deployment using default configurations."
}