CVE-2026-120214 @fastify/http-proxy CVE debrief

Who should care

Fastify users who have installed the @fastify/http-proxy plugin should upgrade to version 11.6.3 or later to fix the vulnerability and monitor for potential exploitation attempts. The vulnerability has a confidentiality impact, and exploitation depends on the upstream's path handling.

Why it matters

CVE-2026-120214 is a vulnerability in the @fastify/http-proxy plugin for Fastify that allows an unauthenticated remote attacker to retrieve upstream resources outside the intended prefix by manipulating the request path. The issue is fixed in version 11.6.3. Fastify users who have installed the @fastify/http-proxy plugin should upgrade to version 11.6.3 or later to fix the vulnerability and monitor for potential exploitation attempts.

• Confidentiality impact: an attacker can retrieve upstream resources outside the intended prefix
• Upgrade priority: upgrade to version 11.6.3 or later to fix the vulnerability
• Monitoring priority: monitor for potential exploitation attempts

Technical summary

The @fastify/http-proxy plugin for Fastify is vulnerable to a path traversal attack. An unauthenticated remote attacker can manipulate the request path to retrieve upstream resources outside the intended prefix. The vulnerability is caused by the plugin's normalization of literal backslashes before percent-decoding the request path, which allows an attacker to bypass the dot-segment check and access resources outside the intended prefix. The issue is fixed in version 11.6.3, and users should upgrade to 11.6.3 or later.

Defensive priority

Upgrade to version 11.6.3 or later

Recommended defensive actions

• Upgrade to version 11.6.3 or later
• Review and update affected systems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows an attacker to retrieve upstream resources outside the intended prefix by manipulating the request path. The issue is fixed in version 11.6.3. The vulnerability has a confidentiality impact, and exploitation depends on the upstream's path handling. The @fastify/http-proxy plugin for Fastify is vulnerable to a path traversal attack. An unauthenticated remote attacker can manipulate the request path to retrieve upstream resources outside the intended prefix. The vulnerability was reported to the vendor, and a 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.