Impact: @fastify/http-proxy versions from 9

@fastify/http-proxy is a Fastify plugin that fronts internal services and enforces access boundaries by rewriting an external prefix onto a restricted upstream rewritePrefix. The HTTP path was hardened against traversal after CVE-2021-21322, but the WebSocket upgrade path was left using new URL(dest, upstream), which performs RFC-3986 resolution and collapses .. segments. That means a WS client sending /public/../admin/socket escapes the intended subtree and opens a bidirectional session against any upstream WebSocket endpoint the proxy can reach. Affected: 9.4.0 through 11.5.0 inclusive; fixed in 11.6.0.

Vendor severity of HIGH (8.7) is close, but slightly inflated. The exploit is unauth-remote (PR:N) with scope-change (S:C), which pushes CVSS up hard — however AC:H is legitimate because the attacker needs a deployment that (a) enables websocket: true, (b) uses rewritePrefix as an actual security boundary rather than a routing convenience, and (c) exposes hidden WS endpoints upstream. That's a real subset, not universal. Role still matters: this plugin *is* a trust boundary by design, so when the chain lands, it lands on the exact surface it was supposed to protect.

Why this verdict

• Trust-boundary role multiplier: @fastify/http-proxy is deployed specifically to enforce prefix-based isolation; the chain succeeds exactly where the defender expected protection — floor stays at HIGH
• Unauth remote, no user interaction: any WS-capable client on the internet can throw the exploit; no phishing, no credential theft required
• Downward pressure — HTTP paths unreachable: the S:C impact is bounded to what upstream WS handlers exist; deployments without sensitive WS endpoints upstream see functionally no impact, which is why 8.7 slightly overshoots
• Downward pressure — deployment prerequisite is real: requires websocket: true AND rewritePrefix used as an authorization edge (not merely routing); a meaningful minority of installs, not the default
• Role multiplier — high-value deployments: when this plugin fronts an internal admin/control WS bus (a common pattern), blast radius extends to whatever that bus can do — sufficient to hold the HIGH floor

Why not higher?

Not CRITICAL because impact is capped at reachable WebSocket endpoints only — the plugin still terminates HTTP path traversal correctly, so no fleet-scale or CA/hypervisor-class blast radius applies. Scope-change (S:C) is real but bounded to a single proxy tenant's upstream. No availability impact.

Why not lower?

Not MEDIUM because the affected component is by-design a trust boundary; downgrading it would ignore role. Unauth-remote plus scope-change on a gateway plugin, with a trivial wscat PoC included in the advisory, keeps this squarely in HIGH territory.

1. Disable websocket: true where WS proxying isn't strictly required — Removes the entire vulnerable code path. Search your Fastify plugin registrations for require('@fastify/http-proxy') and set websocket: false (or omit) — deploy within 30 days per the noisgate HIGH mitigation SLA.
2. Normalize .. in the upgrade path at the front edge — Configure your CDN/ingress (Cloudflare, nginx, Envoy, ALB) to reject or normalize .. sequences in the request-line of WS Upgrade requests before they reach Fastify. nginx: if ($request_uri ~ "\.\./") { return 400; }. Ship within 30 days.
3. Add per-endpoint auth on upstream WS handlers — Stop treating rewritePrefix as a sufficient authorization boundary. Require a signed token on the WS handshake (Sec-WebSocket-Protocol or query param) that the upstream validates itself. This is the durable fix regardless of proxy version.
4. Upgrade @fastify/http-proxy to ≥ 11.6.0 — The actual remediation — patches wsProxy to validate the resolved URL stays under rewritePrefix. Land within the noisgate HIGH remediation SLA of ≤ 180 days, prioritized where WS proxying is enabled.
5. SBOM sweep and alert on unpatched consumers — Query your SCA/SBOM tooling (Snyk, Dependabot, Socket, GitHub Advisory) for @fastify/http-proxy in the 9.4.0–11.5.0 range across all repos and container images. Alert on new installs of vulnerable versions.

Run this on any host or CI job with access to your repository/container-image tree. Invoke as ./check-fastify-http-proxy.sh /path/to/repo-or-node_modules. No elevated privileges required — reads package.json and node_modules metadata only.

#!/usr/bin/env bash
# check-fastify-http-proxy.sh — CVE-2026-15631 detector
# Vulnerable: @fastify/http-proxy 9.4.0 <= x <= 11.5.0
# Fixed: 11.6.0
set -u

TARGET="${1:-.}"
STATUS="UNKNOWN"
FOUND=0
VULN=0

ver_le() { # returns 0 if $1 <= $2 (semver, x.y.z)
  [ "$1" = "$2" ] && return 0
  printf '%s\n%s\n' "$1" "$2" | sort -V -C 2>/dev/null && return 0 || return 1
}

in_range() { # 9.4.0 <= v <= 11.5.0
  local v="$1"
  ver_le "9.4.0" "$v" || return 1
  ver_le "$v" "11.5.0" || return 1
  return 0
}

# 1. Installed packages
while IFS= read -r pjson; do
  name=$(grep -oE '"name"[[:space:]]*:[[:space:]]*"[^"]+"' "$pjson" | head -1 | sed -E 's/.*"([^"]+)"$/\1/')
  ver=$(grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' "$pjson" | head -1 | sed -E 's/.*"([^"]+)"$/\1/')
  if [ "$name" = "@fastify/http-proxy" ] || [ "$name" = "fastify-http-proxy" ]; then
    FOUND=1
    if in_range "$ver"; then
      echo "VULNERABLE install: $pjson  ($name@$ver)"
      VULN=1
    else
      echo "OK install: $pjson  ($name@$ver)"
    fi
  fi
done < <(find "$TARGET" -type f -name package.json -path '*/node_modules/*' 2>/dev/null)

# 2. Declared deps in root manifests / lockfiles
while IFS= read -r f; do
  if grep -qE '"@?fastify[-/]http-proxy"' "$f" 2>/dev/null; then
    echo "Declared dependency reference: $f"
    FOUND=1
  fi
done < <(find "$TARGET" -maxdepth 4 -type f \( -name package.json -o -name package-lock.json -o -name yarn.lock -o -name pnpm-lock.yaml \) 2>/dev/null | grep -v node_modules)

if [ "$VULN" = "1" ]; then
  STATUS="VULNERABLE"
elif [ "$FOUND" = "1" ]; then
  STATUS="UNKNOWN (dependency present — inspect resolved version)"
else
  STATUS="PATCHED (no @fastify/http-proxy in tree)"
fi

echo "---"
echo "STATUS: $STATUS"
case "$STATUS" in
  VULNERABLE*) exit 2 ;;
  UNKNOWN*)    exit 1 ;;
  *)           exit 0 ;;
esac

Sources

1. GHSA-7hrw-592w-9wh2 (advisory)
2. fastify-http-proxy repository
3. npm — @fastify/http-proxy
4. CVE-2021-21322 (related HTTP-side variant)
5. OpenJS Foundation Security Advisories
6. Snyk — fastify package tree
7. CWE-22 — Path Traversal
8. Socket.dev — @fastify/http-proxy