Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120214— @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

Quick assessment

Affected
@fastify/http-proxy @fastify/http-proxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 Fastify 插件，用于将 HTTP 请求代理到配置前缀下的上游服务器。在 11.6.0 至 11.6.2 版本中，目标地址验证逻辑在百分号解码请求路径之前，先对字面反斜杠进行了规范化处理。因此，若攻击者将路径中的反斜杠和点段（dot-segments）进行编码，该路径便能绕过点段检查；而在检查通过后，这些编码会被解码为反斜杠和双点序列。当上游服务器运行在将反斜杠视为路径分隔符的平台上时，转发的请求便会跳出配置的代理前缀，访问到上游服务器上的同级目录位置。未认证的远程攻击者可利用此漏洞获取配置前缀之外的上

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120214

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/http-proxy @fastify/http-proxy 11.6.0 ~ 11.6.3 -

II. Public POCs for CVE-2026-120214

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120214

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-120214 (1)

IV. Related Vulnerabilities

Same product: @fastify/http-proxy
Same vendor: @fastify/http-proxy
Same weakness: CWE-22