CVE-2026-120213

Summary

The @fastify/http-proxy plugin incorrectly decodes URL parameters in rewritePrefix without re-encoding them, allowing attackers to inject path separators and query delimiters via encoded characters (e.g., %2f) to bypass intended upstream path restrictions and access unintended endpoints.

Exploitability

Exploitation is straightforward for unauthenticated remote attackers; no user interaction or special privileges are required, and public exploits exist.

Blast radius

Successful exploitation enables server-side request forgery (SSRF) or authorization bypass in the upstream service, potentially exposing sensitive internal resources or data.

Detection

Look for upstream requests where the path contains unexpected segments that correspond to decoded URL-encoded characters (e.g., %2f appearing as / in the final upstream path), especially when such paths deviate from the configured rewritePrefix pattern; logs from the proxy or upstream server may show anomalous request paths.

Prioritized remediation

Upgrade @fastify/http-proxy to version 11.6.6 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.