@fastify/http-proxy vulnerabilities
We track 4 vulnerabilities in @fastify/http-proxy products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest @fastify/http-proxy vulnerabilities
- 9.1 Critical severity
@fastify/http-proxy: Improper Limitation of a Pathname to a Restricted Directory
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream pat
- 7.5 High severity
@fastify/http-proxy: Improper Limitation of a Pathname to a Restricted Directory
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path pe
- 10.0 Critical severity
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request…
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-
- 10.0 Critical severity
@fastify/http-proxy: Improper Limitation of a Pathname to a Restricted Directory
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via th