Path Restriction Bypass Vulnerability in @fastify/http-proxy Plugin

CVE-2026-120213

What is CVE-2026-120213?

The @fastify/http-proxy plugin, which facilitates HTTP request proxying to upstream servers, contains a vulnerability that affects versions 9.0.0 to 11.6.5. When the plugin is configured with parameterized prefix and rewritePrefix options to limit client access to a specific upstream path, it fails to re-encode URL-decoded route parameters into rewritePrefix. This oversight can lead to unauthorized access, allowing an attacker to manipulate the request and access locations beyond the intended prefix. The defect enables unauthenticated remote attackers to execute a path-restriction bypass, potentially resulting in server-side request forgery or authorization bypass, depending on the specifics of the proxied service. It is critical to upgrade to version 11.6.6 or later to mitigate this issue, as there are no workarounds available.

References