# CVE-2026-120213: @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- @fastify/http-proxy / @fastify/http-proxy (@fastify/http-proxy): ≥ 9.0.0; < 11.6.6 (affected, semver); 11.6.6 (unaffected, semver). Source: CNA: openjs

## Severity and prioritization

- CVSS 3.1: 9.1 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; source: CNA: openjs

- CVSS 3.1: 9.1 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; source: NVD: ce714d77-add3-4f53-aff5-83d477b104bb

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22, CWE-436

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364 (CNA: openjs)

- https://cna.openjsf.org/security-advisories.html (CNA: openjs)

- https://cna.openjsf.org/security-advisories.html (ce714d77-add3-4f53-aff5-83d477b104bb)

- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364 (ce714d77-add3-4f53-aff5-83d477b104bb)

## Provenance

- CNA: openjs: https://www.cve.org/CVERecord?id=CVE-2026-120213; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120213; retrieved 2026-11-02; source updated 2026-11-02

Revision: b6fc30fe64e8accbeed0f1afde677b04142165d450a4388a2106221bbe3639c4

Canonical: https://y2.dev/cve/CVE-2026-120213