Signal is active with 6 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 Critical-severity security fix in @fastify/http-proxy@11.6.0 just released! Patches CVE-2026-16117, prefix escape via URL-encoded characters. https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-mx7v-qhg9-2mvv
Post summary
Fastify’s 11.6.0 release includes a critical fix for CVE‑2026‑16117, correcting a prefix‑escape issue; the advisory and patch are publicly disclosed via GitHub.
🚨 CRITICAL - Encoded prefix rewrite bypass in Fastify HTTP Proxy (CVE-2026-16117) @fastify/http-proxy up to 11.5.0 fails to rewrite the configured request prefix when the prefix segment is URL-encoded, allowing the original path to reach the upstream. The root cause is improper input normalization: decoded route matching is combined with a literal string replacement during rewritePrefix, creating an encoding mismatch. An attacker can exploit this remotely by sending requests with URL-encoded characters in the configured prefix so the proxy matches the route but does not rewrite, and the upstream then receives and decodes the unmodified path. Impact is full proxy path bypass, exposing upstream routes intended to be hidden, including internal/admin endpoints, potentially leading to sensitive data exposure and unauthorized administrative actions. 👉 Affected: @fastify/http-proxy <= 11.5.0 | Upgrade to 11.6.0
Post summary
Fastify HTTP Proxy (<=11.5.0) is vulnerable to an encoded prefix rewrite bypass that allows attacker-controlled paths to reach the upstream server. A patch is available in version 11.6.0.
🚨 CRITICAL - Encoded prefix rewrite bypass in Fastify HTTP Proxy (CVE-2026-16117) @fastify/http-proxy up to 11.5.0 fails to rewrite the configured request prefix when the prefix segment is URL-encoded, allowing the original path to reach the upstream. The root cause is improper input normalization: decoded route matching is combined with a literal string replacement during rewritePrefix, creating an encoding mismatch. An attacker can exploit this remotely by sending requests with URL-encoded characters in the configured prefix so the proxy matches the route but does not rewrite, and the upstream then receives and decodes the unmodified path. Impact is full proxy path bypass, exposing upstream routes intended to be hidden, including internal/admin endpoints, potentially leading to sensitive data exposure and unauthorized administrative actions. 👉 Affected: @fastify/http-proxy <= 11.5.0 | Upgrade to 11.6.0
Post summary
A critical prefix rewrite bypass in Fastify HTTP Proxy allows attackers to subvert path rewriting, exposing hidden upstream routes. The issue is fixed in version 11.6.0.
CVE-2026-16117 URL-Encoded Prefix Bypass in @fastify/http-proxy Versions Up to 1... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16117 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE-2026-16117—a URL-encoded prefix bypass in fastify/http-proxy—and links to a vulnerability details page, but provides no technical depth or exploitation evidence.
🚨*CVE* CVE-2026-16117 Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decode… https://www.cve.org/CVERecord?id=CVE-2026-16117 ----- Traducción: CVE-2026-16117 Imp… http://infoflow.cloud`
Post summary
CVE-2026-16117 is disclosed as affecting @fastify/http‑proxy up to version 11.5.0, where URL‑encoded prefix segments are not rewritten, and the CVE record can be viewed at cve.org.
CVE-2026-16117 Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decode… https://www.cve.org/CVERecord?id=CVE-2026-16117
Post summary
This post discloses a URL‑encoding issue in fastify/http‑proxy that prevents proper prefix rewriting, as documented in the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/http-proxy | - | node.js | - |