'@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.

CVE-2026-85124 affects @fastify/http-proxy versions prior to 11.6.2, which fail to validate proxied HTTP request paths containing backslash-based dot-segments before forwarding them upstream. The plain HTTP request handler lacks the destination validation present in the WebSocket path handler, and the underlying reply-from library only rejects forward-slash traversal sequences. This gap allows attackers to craft requests with backslash dot-segments that escape the boundaries enforced by the prefix and rewritePrefix options. An unauthenticated network attacker can exploit this to access upstream paths intentionally hidden behind the proxy, leading to disclosure of internal endpoints. The vulnerability is classified as CWE-22 (Path Traversal). No authentication is required to exploit this issue, increasing its severity. The fix is available in @fastify/http-proxy version 11.6.2 or later, and all users are advised to upgrade immediately.