'@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

A path traversal vulnerability (CWE-22) exists in @fastify/http-proxy versions before 11.6.2. The plain HTTP request handler fails to validate backslash-based dot-segments in proxied request paths before forwarding them upstream. Unlike the WebSocket path handler, the HTTP handler skips destination validation, and the underlying reply-from library only blocks forward-slash traversal. This allows an unauthenticated network attacker to craft requests with backslash dot-segments that escape the boundaries set by the prefix and rewritePrefix options. The result is unauthorized access to internal upstream endpoints meant to be hidden behind the proxy, leading to disclosure of sensitive internal routes. Users are advised to upgrade to @fastify/http-proxy version 11.6.2 or later to remediate the issue.