CVE-2026-120213: Path bypass in @fastify/http-proxy 11.6.5

CVE-2026-120213 affects @fastify/http-proxy, a Fastify plugin for HTTP request proxying to upstream servers. Versions 9.0.0 through 11.6.5 fail to re-encode URL parameters after decoding, allowing an unauthenticated remote attacker to inject path separators into parameters. The vulnerability bypasses path restrictions and reaches upstream locations outside the configured prefix, leading to SSRF (Server-Side Request Forgery) and potential authorization bypass in proxied services.

The vulnerability is classified as critical with CVSS 9.1. No public exploit has been reported in accessible repositories. However, signals on X show 3 posts in the last 24 hours citing the CVE and the released fix. The patch is available in @fastify/http-proxy version 11.6.6, released on November 2, 2026. No workaround is available: upgrading is the only mitigation solution.

Administrators and security officers must immediately verify whether they are using @fastify/http-proxy with versions earlier than 11.6.6. If a vulnerable version (9.0.0–11.6.5) is in use, plan an upgrade to 11.6.6 or later with high priority. Review access logs and routing records for unusual access attempts to paths outside those specified by rewritePrefix, which may indicate exploitation of this vulnerability.

Before upgrading, verify the context in which the plugin is used: understand whether rewritePrefix is configured to pin clients to fixed upstream paths and whether the configuration uses parameters in the prefix. After updating, test routing behavior to ensure parameters are handled correctly and the prefix is always enforced.