Vulnerability in Fastify HTTP Proxy Plugin Allows Unauthenticated Resource Retrieval

CVE-2026-120214

What is CVE-2026-120214?

The @fastify/http-proxy plugin allows HTTP request handling with the potential for unauthorized access to upstream resources. Versions 11.6.0 through 11.6.2 fail to properly validate destination paths, which can let unauthenticated attackers manipulate the proxy prefix and access sensitive data outside intended boundaries. This issue highlights the need for careful path validation when dealing with encoded requests. Users are strongly encouraged to update to version 11.6.3 or later to protect against this vulnerability.

References