A critical path-traversal flaw in Fastify's http-proxy plugin has been fixed in version 11.6.6, and the vendor says upgrading is the only remedy, with no workaround available.

The flaw, CVE-2026-120213, was published on 2 November 2026 with a CVSS score of 9.1, rated critical. It affects @fastify/http-proxy versions 9.0.0 through 11.6.5. According to the vendor advisory, URL-decoded route parameters are substituted into the rewritePrefix setting without re-encoding, so a decoded slash combined with a hash or question mark can inject extra upstream path segments and strip the enforced suffix.

What it could expose

That prefix escape could let an attacker reach upstream paths that were meant to stay hidden, with possible server-side request forgery or authorisation bypass depending on how the upstream service is configured. The flaw is not known to be exploited, and it was not listed in the US CISA Known Exploited Vulnerabilities catalogue at the time of the OffSeq check on 2 November.

Administrators running the plugin should upgrade to 11.6.6 or later and check whether any proxy rules rely on rewritePrefix to restrict access, since those rules alone do not mitigate the flaw. The advisory is a reminder that proxy configuration, not just application code, needs the same patch discipline as any internet-facing component.

Sources: Fastify vendor advisory GHSA-h3vp-4jfr-v364; OffSeq Threat Radar, CVE-2026-120213, 2 November 2026.