External risk intelligence

@fastify/http-proxy WebSocket Path Traversal Leading to Upstream Endpoint Exposure

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-15631

The vulnerability affects an HTTP proxy component designed to handle and route requests, including WebSocket traffic. As a proxy or gateway service, it is commonly deployed in internet-facing architectures to manage, forward, or terminate traffic, making it a natural part of the public-facing edge or backend API infrastructure in many production deployments.

Path Traversal

Fastify\/http Proxy

9.4.0 to before 11.6.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a component that handles network traffic, specifically impacting how it manages WebSocket connections. The issue arises from an incomplete validation of destination paths, which could allow specially crafted requests to bypass intended routing and potentially expose unintended upstream endpoints. While exploitation requires specific client configurations, the nature of proxy components means this could be a concern in certain production environments.

Proxy misconfiguration can expose unexpected services.
Affects a component that routes external traffic.
Confirm relevance to your proxy deployments.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this by sending specially crafted WebSocket upgrade requests through a non-normalizing client or a downstream proxy. These requests can bypass the configured rewrite prefix due to how the proxy resolves WebSocket destinations, potentially exposing unintended upstream endpoints.

Requires un-normalized WebSocket client.
Bypasses rewrite prefix via path traversal.
Exposes unintended upstream endpoints.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker to bypass configured rewrite prefixes and access unintended upstream WebSocket endpoints. This occurs because the WebSocket destination path is not properly validated, allowing path traversal sequences to escape the intended proxy configuration. The attack is feasible when a non-normalizing WebSocket client is used, or when raw HTTP clients forward the request target unchanged.

Unintended upstream WebSocket endpoints.
Path traversal in crafted upgrade requests.
Unauthorized access to backend services.

Operational Fix

Recommended remediation, mitigation, and detection steps

The @fastify/http-proxy component is likely managed by platform or application teams, with potential involvement from network and security teams for exposure analysis. The first step is to identify all instances of the affected proxy versions, determine their network reachability and criticality, and then assign ownership for remediation planning.

Platform or application teams own the issue.
Verify proxy reachability and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the @fastify/http-proxy package used for?

This software is a Node.js component that functions as a bridge for web applications. Developers use it to route incoming HTTP and WebSocket traffic to different backend services, effectively acting as a gateway or traffic controller that manages where data requests are sent within a server architecture.

What is the vulnerability in CVE-2026-15631?

This issue is a path traversal weakness, categorized as CWE-22. It occurs because the software fails to properly check if a requested path stays within its allowed boundaries. An attacker can use special character sequences to 'climb' out of the designated route and reach private backend systems that the proxy was never intended to expose.

How does an attacker trigger this path traversal?

An attacker must send a specially crafted WebSocket upgrade request. The bug is triggered when these requests use path traversal sequences to bypass routing rules. Notably, standard web browsers and common libraries will not trigger this, as they normalize request paths automatically. The vulnerability is only reachable via raw HTTP clients or specific proxies that pass the request target forward without modification.

Is my deployment at risk from this CVE?

Halo Surface Signal indicates this is a high-priority concern because the software is designed to manage public-facing traffic. If you use this proxy to handle external connections or route requests at the edge of your infrastructure, it is more likely to be accessible to unauthorized traffic. You should verify if your proxy instances are configured to handle WebSocket traffic from untrusted sources.

How should I respond to this threat advisory?

The primary response is to update the @fastify/http-proxy dependency to version 11.6.0. Before patching, platform teams should inventory all applications using affected versions to determine which are reachable from external networks. Since no workarounds exist, prioritizing the software update is the only effective way to prevent the routing bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.