External risk intelligence

@fastify/http-proxy Path Restriction Bypass via Parameter Substitution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-120213

The vulnerability affects a proxy plugin designed to handle HTTP requests and route them to upstream servers. Since this plugin is commonly used in web applications, APIs, and gateway services that are intentionally exposed to the internet to proxy traffic, the vulnerable component is likely to be found in public-facing network infrastructure.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a widely used web proxy plugin, potentially allowing unauthenticated attackers to access unintended parts of your internal network. The issue arises from how the plugin handles URL parameters, leading to bypasses of security controls and possible unauthorized access to proxied services.

Proxy plugin bypasses security.
Critical for systems handling external requests.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a web application that uses the affected proxy plugin. The plugin, when configured with specific options for handling user-provided path parameters, incorrectly decodes these parameters. This misinterpretation allows an attacker to bypass intended path restrictions, potentially accessing sensitive upstream resources or services that should not be exposed.

Network access required.
Triggered by crafted proxy requests.
Risk of unauthorized access to upstream services.

Live Threat

Current exploitation, exposure, and threat context

When applications use @fastify/http-proxy with parameterized prefix and rewritePrefix options, attackers could bypass configured path restrictions. This bypass could expose sensitive information or allow unauthorized actions on proxied services.

Proxied service data and functionality.
Unauthenticated network requests bypassing restrictions.
Path-restriction bypass, potential SSRF, or auth bypass.

Operational Fix

Recommended remediation, mitigation, and detection steps

The @fastify/http-proxy plugin is used to proxy HTTP requests to upstream servers. This vulnerability allows unauthenticated remote attackers to bypass path restrictions and potentially achieve server-side request forgery or authorization bypass, depending on the upstream service. Owners of applications using this plugin must first identify all instances of @fastify/http-proxy, determine their reachability and criticality, and then plan remediation.

Application owners and platform teams.
Verify affected proxy instances and upstream exposure.
Upgrade to the latest version of @fastify/http-proxy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @fastify/http-proxy?

@fastify/http-proxy is a plugin for the Fastify web framework designed to forward incoming HTTP requests to another server. It acts as a gateway or intermediary, allowing developers to route traffic from a single entry point to various backend services while managing URL transformations and path prefixes.

What does CVE-2026-120213 mean?

This CVE describes an improper handling of URL parameters in the plugin, categorized under CWE-22 (path traversal) and CWE-436 (interpretation conflict). When the plugin tries to rewrite request paths using user-provided data, it fails to properly re-encode parameters. An attacker can insert special characters to trick the plugin into looking at parts of the upstream server it was never intended to access.

How does an attacker trigger this bug?

An attacker triggers this by sending a crafted HTTP request containing specific URL-encoded characters. These characters are decoded by the plugin but not re-encoded before being passed to the upstream server. The vulnerability does not require complex 'dot-dot' sequences; it only manifests when the plugin is specifically configured to use parameterized prefixes to pin requests to fixed upstream paths.

Is my application at risk?

If your application exposes @fastify/http-proxy to the internet, your risk is elevated because the plugin acts as a gateway. According to Halo Surface Signal, this component is frequently found in public-facing network infrastructure. Even internal services could be at risk if they are reachable by unauthorized users within your network.

How do I fix this issue?

The only effective way to remediate this vulnerability is to upgrade your @fastify/http-proxy package to version 11.6.6 or later. Start by auditing your environment to locate all instances of the plugin, then prioritize updating those that handle untrusted traffic or provide access to sensitive internal resources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.