CVE-2026-85124: @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-

This month

HIGH 7.5REMOTEUPGRADE

CVE-2026-85124 is a high-severity flaw (CVSS 7.5) affecting fastify\/http-proxy. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.7% (top 46%)
CISA exploited list	No
Weakness	CWE-22
Published	2026-09-03
Last modified	2026-09-09

Publisher (CNA): openjs · Vendor: fastify

Last updated 2026-09-09 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-09-03 13:06 UTCPublished CVE record published
2026-09-09 19:25 UTCUpdated Record last modified

fastify fastify\/http-proxy UPGRADE

Affected: < 11.6.2

Fixed in: 11.6.2

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls fastifyhttp-proxy

2. UPGRADE to 11.6.2

npm install fastifyhttp-proxy@">=11.6.2"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-85124?

fastify\/http-proxy: upgrade to 11.6.2. Exact commands for each OS are on this page.

Is CVE-2026-85124 being exploited?

CVE-2026-85124 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-85124 affect?

CVE-2026-85124 affects fastify\/http-proxy. Severity is high (CVSS 7.5). @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that t

How urgent is CVE-2026-85124?

Priority 45/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-33805 HIGH 8.6 UPGRADE UPGRADE @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Conne
CVE-2026-15631 HIGH 8.7 UPGRADE Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSo
CVE-2026-16117 CRITICAL 10.0 UPGRADE Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the pr

References

← Back to latest CVEs