---
id: "CVE-2026-120214"
kind: "vulnerability"
aliases: ["CVE-2026-120214"]
title: "@fastify/http-proxy: encoded backslashes let requests escape the proxy prefix"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fastify", "node", "package", "self-hosted"]
not_affected_if: ["upstream-not-backslash-separator", "version-outside-11.6.0-11.6.2"]
published_at: "2026-11-02T11:17:31+00:00"
first_seen_at: "2026-11-02T11:22:54+00:00"
updated_at: "2026-11-02T11:24:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120214", "first_seen_at": "2026-11-02T11:22:54+00:00"}]
---

# @fastify/http-proxy: encoded backslashes let requests escape the proxy prefix

Versions 11.6.0 through 11.6.2 of the Fastify proxy plugin check request paths in the wrong order, so encoded backslash and dot-segment sequences slip past validation. When the upstream treats backslashes as path separators, an unauthenticated remote attacker can read upstream resources outside the configured prefix.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@fastify/http-proxy` in your lockfile or with `npm ls @fastify/http-proxy`.
- Confirm whether your upstream runs on a platform that treats backslash as a path separator (unknown if the sources do not say which platforms).

## Fix

- `@fastify/http-proxy` `11.6.3` or later.

## Timeline

- 2026-11-02T11:22:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120214

## Documents

- [advisory] Vendor advisory: github.com https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv

## From the sources

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_