{"api_version":"1","generated_at":"2026-09-03T23:01:11+00:00","cve":"CVE-2026-85124","urls":{"html":"https://cve.report/CVE-2026-85124","api":"https://cve.report/api/cve/CVE-2026-85124.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-85124","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-85124"},"summary":{"title":"@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments","description":"@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.","state":"PUBLISHED","assigner":"openjs","published_at":"2026-09-03 13:06:21","updated_at":"2026-09-03 18:11:49"},"problem_types":["CWE-22","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[{"version":"3.1","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","name":"https://cna.openjsf.org/security-advisories.html","refsource":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5","name":"https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5","refsource":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85124","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85124","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"@fastify/http-proxy","product":"@fastify/http-proxy","version":"affected 11.6.2 semver","platforms":[]},{"source":"CNA","vendor":"@fastify/http-proxy","product":"@fastify/http-proxy","version":"unaffected 11.6.2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"EQSTLab","lang":"en"},{"source":"CNA","value":"mcollina","lang":"en"},{"source":"CNA","value":"UlisesGascon","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-85124","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-03T12:31:02.813629Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-03T12:32:56.358Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/http-proxy","product":"@fastify/http-proxy","vendor":"@fastify/http-proxy","versions":[{"lessThan":"11.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"11.6.2","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"EQSTLab"},{"lang":"en","type":"remediation developer","value":"mcollina"},{"lang":"en","type":"remediation developer","value":"UlisesGascon"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later."}],"value":"@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-03T10:51:24.281Z","orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","shortName":"openjs"},"references":[{"url":"https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5"},{"url":"https://cna.openjsf.org/security-advisories.html"}],"title":"@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments","x_generator":{"engine":"cve-kit 1.0.0"}}},"cveMetadata":{"assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","assignerShortName":"openjs","cveId":"CVE-2026-85124","datePublished":"2026-09-03T10:51:24.281Z","dateReserved":"2026-09-03T08:15:18.564Z","dateUpdated":"2026-09-03T12:32:56.358Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-03 13:06:21","lastModifiedDate":"2026-09-03 18:11:49","problem_types":["CWE-22","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-03T12:31:02.813629Z","id":"CVE-2026-85124","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"85124","Ordinal":"1","Title":"@fastify/http-proxy vulnerable to prefix escape via backslash do","CVE":"CVE-2026-85124","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"85124","Ordinal":"1","NoteData":"@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.","Type":"Description","Title":"@fastify/http-proxy vulnerable to prefix escape via backslash do"}]}}}