CVE-2026-15631 fastify CVE debrief

Who should care

Developers and administrators using @fastify/http-proxy in their applications, especially those with exposed WebSocket endpoints, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing and updating WebSocket clients, monitoring for suspicious requests, and upgrading to version 11.6.0 or later.

Technical summary

The vulnerability arises from the failure to validate the resolved WebSocket destination path against the configured rewrite prefix in @fastify/http-proxy. This allows crafted upgrade requests with path traversal sequences to escape the rewrite prefix and reach unintended upstream endpoints. Exploitation requires a non-normalizing WebSocket client, as browsers and certain packages normalize the request path before sending it. The issue affects @fastify/http-proxy versions from 9.4.0 to 11.5.0.

Defensive priority

High priority should be given to upgrading to @fastify/http-proxy version 11.6.0 or later, as this version addresses the vulnerability. Additionally, reviewing and updating WebSocket clients, monitoring for suspicious requests, and confirming affected deployments are crucial defensive measures.

Recommended defensive actions

• Upgrade to @fastify/http-proxy version 11.6.0 or later.
• Review and update any WebSocket clients to ensure they do not normalize request paths in a way that would prevent exploitation.
• Monitor for any suspicious WebSocket upgrade requests that could indicate attempted exploitation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.7 and severity classification as HIGH. The OpenJSF CNA has also published an advisory on this issue. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for specific mitigation steps.

Official resources