Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-16117— @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Quick assessment

Affected
@fastify/http-proxy @fastify/http-proxy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fastify @fastify/http-proxy是Fastify团队的一个HTTP代理模块。 Fastify @fastify/http-proxy 11.5.0及之前版本存在输入验证错误漏洞，该漏洞源于URL编码后的前缀段未能正确重写请求前缀，可能导致攻击者绕过代理配置的rewritePrefix，访问内部或管理端点。

CVSS 10.0 · Critical EPSS 0.44% · P36

Possible ATT&CK Techniques 1 AI

T1071 · Application Layer Protocol

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/http-proxy @fastify/http-proxy < 11.6.0 affected
11.6.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16117

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
Source: CVE Program / CVE List V5
Vulnerability Description
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Fastify @fastify/http-proxy 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fastify @fastify/http-proxy是Fastify团队的一个HTTP代理模块。 Fastify @fastify/http-proxy 11.5.0及之前版本存在输入验证错误漏洞，该漏洞源于URL编码后的前缀段未能正确重写请求前缀，可能导致攻击者绕过代理配置的rewritePrefix，访问内部或管理端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/http-proxy @fastify/http-proxy 0 ~ 11.6.0 -

II. Public POCs for CVE-2026-16117

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 8297 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-16117

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-16117 (1)

IV. Related Vulnerabilities

Same product: @fastify/http-proxy
Same vendor: @fastify/http-proxy
Same weakness: CWE-20

V. Comments for CVE-2026-16117

No comments yet

Leave a comment