Path Traversal Vulnerability in @fastify/http-proxy Affects Fastify Framework

CVE-2026-85124

What is CVE-2026-85124?

A path traversal vulnerability exists in versions prior to 11.6.2 of @fastify/http-proxy that allows a network attacker to manipulate proxied HTTP request paths. The vulnerability arises because the system fails to properly validate backslash-based dot-segments. As a consequence, attackers can potentially access restricted upstream paths, leading to the disclosure of internal endpoints that should remain protected. To mitigate this risk, users are advised to upgrade to version 11.6.2 or later.

References