@fastify/http-proxy prefix escape via encoded backslash dot-segments

The @fastify/http-proxy plugin forwards requests under a configured prefix and validates that the destination stays inside it. In versions 11.6.0 through 11.6.2, the validator normalizes literal backslashes first and only then percent-decodes the path. Attackers can send %5c and %2e%2e sequences that pass the dot-segment check, then become \.. after decoding. On an upstream that treats backslash as a path separator — most commonly a Windows-hosted service — the forwarded request climbs out of the prefix and reaches a sibling location.

The vendor's MEDIUM severity is broadly correct but a touch high for typical Linux-heavy Fastify deployments. The exploit only fires when the upstream is Windows or similarly configured, and only when sensitive resources exist outside the intended prefix. Across a 10,000-host estate, the realistic exposure is a subpopulation of reverse-proxy-to-Windows setups, so we assess this at the low end of MEDIUM.

Sources.

1. NVD CVE-2026-120214
2. CVE.org record
3. GitHub repository
4. GitHub release v11.6.3
5. npm package page
6. pocindex search
7. CISA KEV catalog
8. EPSS

Run this script on each host where a Fastify app using @fastify/http-proxy is deployed, from the application root or with the app directory as the first argument. Example: bash check_fastify_http_proxy_cve-2026-120214.sh /srv/myapp. Requires read access to the app's node_modules and node on PATH.

#!/usr/bin/env bash
set -euo pipefail

# CVE-2026-120214: @fastify/http-proxy 11.6.0-11.6.2 prefix escape
TARGET_DIR="${1:-$(pwd)}"
cd "$TARGET_DIR" || { echo "UNKNOWN: cannot access $TARGET_DIR"; exit 3; }

if ! command -v node >/dev/null 2>&1; then
  echo "UNKNOWN: node not found on PATH"
  exit 3
fi

VERSION=""
if [ -f "node_modules/@fastify/http-proxy/package.json" ]; then
  VERSION=$(node -e "console.log(require('./node_modules/@fastify/http-proxy/package.json').version)" 2>/dev/null || true)
else
  VERSION=$(node -e "try{console.log(require('@fastify/http-proxy/package.json').version)}catch(e){}" 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: @fastify/http-proxy not found in $TARGET_DIR"
  exit 3
fi

# Compare to affected range 11.6.0 - 11.6.2
IFS=. read -r major minor patch <<< "$(echo "$VERSION" | tr '-' '.')"
if [[ "$major" == "11" && "$minor" == "6" ]]; then
  if [[ "$patch" =~ ^[0-9]+$ ]] && [ "$patch" -ge 0 ] && [ "$patch" -le 2 ]; then
    echo "VULNERABLE: @fastify/http-proxy $VERSION"
    exit 0
  fi
fi

echo "PATCHED: @fastify/http-proxy $VERSION"
exit 0