VulnSocial

CVE-2026-15631Patch(fastify / fastify\/http-proxy)

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch fastify fastify\/http-proxy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

fastify CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fastify\/http-proxy

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-07-18); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
fastify
Products
fastify\/http-proxy

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-18: 3Mentions · 2026-08-14: 1Patch / Workaround · 2026-07-18: 2Patch / Workaround · 2026-08-14: 1Technical Details · 2026-07-18: 2Technical Details · 2026-08-14: 107-1808-14
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-183
Disclosure1Patch2
2026-08-141
Patch1
Full discourse4 posts
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in @fastify/http-proxy@11.6.0 just released! Patches CVE-2026-15631, prefix escape via WebSocket path traversal. https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-7hrw-592w-9wh2

    Post summary

    The tweet announces the release of a high‑severity patch for fastify/http‑proxy that fixes CVE‑2026‑15631, a prefix escape vulnerability via WebSocket path traversal, and provides a link to the official advisory.

    02022430
    5.5K followersView on X
  • takenaka hiroya@Joe_Biden_ja
    Patch

    @fastify/http-proxy の WebSocket 経路にパストラバーサルを追加しました。HTTP 側の修正が入らなかったコードパスに残っていた形です。悪用にはパスを正規化しないクライアントが要るため、AC:H と評価されています。修正は 11.6.0 です。 https://cve.autoarticles.net/cve/CVE-2026-15631

    Post summary

    A path‑traversal vulnerability (CVE‑2026‑15631) affecting WebSocket routing in fastify/http‑proxy has been disclosed and is fixed in release 11.6.0.

    0000060
    563 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Two Fastify proxy routing flaws let requests reach unintended upstreams (CVE-2026-16158 & CVE-2026-15631) Two official Fastify (OpenJS) proxy plugins have request-routing vulnerabilities, both CVSS 8.7. CVE-2026-16158 (@fastify/reply-from): the internal URL cache key concatenates destination and source paths with no delimiter, so different pairs can collide. A URL cached for one upstream can be reused for a request meant for another, causing cross-upstream data access and modification. The default config is affected. Fixed in 12.6.4 (workaround: disableCache: true). CVE-2026-15631 (@fastify/http-proxy): WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted WebSocket upgrade with traversal sequences can escape the rewrite prefix and reach upstreams that were never meant to be exposed. A WebSocket variant of CVE-2021-21322. Reachable via non-normalizing clients or forwarding proxies. Fixed in 11.6.0 (no workaround). 👉Upgrade @fastify/reply-from to 12.6.4 and @fastify/http-proxy to 11.6.0.

    Post summary

    The post discloses two Fastify proxy routing flaws, details the technical mechanisms, and provides specific patch versions and a workaround.

    00000213
    254 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-15631 Path Traversal in @fastify/http-proxy WebSocket Routing V... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15631 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    The message reports a path traversal issue in @fastify/http-proxy but provides no PoC, exploit, patch, or evidence of active exploitation.

    00000107
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfastifyfastify\/http-proxy-node.js-

Explore more

Back to dashboardfastify CVEsfastify\/http-proxy vulnerabilities