CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
Attackers can bypass prefix rewriting to access hidden upstream paths, including administrative endpoints, by using URL-encoded characters in requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16117?
CVE-2026-16117 is a critical path traversal vulnerability in @fastify/http-proxy, published on 18 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.
Patches: upgrade to @fastify/http-proxy 11.6.0.
Workarounds: none.
Weakness: CWE-20
Which versions are affected by CVE-2026-16117?
It affects 1 product.
Products include Fastify Fastify\/Http-Proxy.
How do I fix CVE-2026-16117?
No fix has been published for CVE-2026-16117 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-16117 being exploited?
There is no known exploitation of CVE-2026-16117 in the wild and no public exploit code.
Other vulnerabilities in @fastify/http-proxy
Sources
Also known as GHSA-mx7v-qhg9-2mvv.