Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High-severity security fix in @fastify/http-proxy@11.6.2 just released! Patches CVE-2026-85124: prefix escape via backslash dot-segments. https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5
Post summary
The tweet announces a high‑severity patch for CVE‑2026‑85124, noting the specific flaw of a prefix escape via backslash dot‑segments.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/http-proxy | - | node.js | - |