CVE-2026-120213: @fastify/http-proxy Prefix Escape via Decoded Route Parameters

Executive Summary

CVE-2026-120213 is a path traversal (CWE-22) flaw in @fastify/http-proxy, the Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. When an application pins clients to a fixed upstream path using a parameterized prefix together with rewritePrefix, the plugin substitutes URL-decoded route parameters into the rewritten path without re-encoding them. An attacker can smuggle /, ? or # characters through a parameter and escape the intended upstream path.

The advisory is tracked as GHSA-h3vp-4jfr-v364 and was published on 2026-11-02. The GitHub advisory rates it critical; the CVSS base score listed by NVD-derived sources is 9.1, although some aggregators score it lower because exploitability depends heavily on the upstream service.

Vulnerability Details

How it works

Consider a route configured as follows:

• prefix: '/tenants/:tenantId/public-avatar'
• rewritePrefix: '/:tenantId/public-avatar'

The intent is that every request is forwarded to /<tenantId>/public-avatar. Because the decoded parameter is inserted verbatim, a request such as /tenants/admin%2fmaster-keys%23/public-avatar is forwarded upstream as GET /admin/master-keys. The decoded # (or ?) truncates the pinned suffix, so the /public-avatar restriction is dropped.

Impact

• Bypass of path restrictions the proxy is meant to enforce
• Access to upstream endpoints never intended to be reachable by clients
• Depending on the upstream, SSRF-like behavior or authorization bypass in the proxied service

Applications that use a fixed prefix with no route parameters are not affected by this specific pattern.

Related Issues

Two earlier or adjacent @fastify/http-proxy issues are tracked separately and are worth checking while you upgrade:

• CVE-2026-16117 (GHSA-mx7v-qhg9-2mvv): versions 11.5.0 and earlier failed to rewrite the prefix when percent-encoded characters were used in the prefix portion of the URL. Fixed in 11.6.0.
• CVE-2026-120214: versions 11.6.0 through 11.6.2 normalize backslashes before percent-decoding, letting encoded backslashes and dot-segments slip past destination validation.

Remediation

1. Upgrade to @fastify/http-proxy 11.6.6 or later (npm ls @fastify/http-proxy to find transitive copies).
2. Search your code for prefix values containing :param segments combined with rewritePrefix.
3. As a stopgap, validate route parameters with a strict schema (for example an alphanumeric pattern) so that %2f, %23 and %3f are rejected before proxying.
4. Make sure upstream services enforce their own authorization rather than relying on the proxy's path pinning.

References

• GitHub Advisory GHSA-h3vp-4jfr-v364
• NVD: CVE-2026-120213