@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

@fastify/http-proxy lets you mount an upstream service under a URL prefix and rewrite that prefix off before forwarding — e.g. /pub/* at the edge is stripped to /* at the backend. The bug is that Fastify's router decodes percent-encoded characters when matching the route, but the prefix-rewriting logic then operates on the raw, still-encoded request.url. A request to /%61pi/data matches the /api route for handler dispatch, but the rewriter can't find the literal string /api in the encoded URL, so no rewrite happens and the raw path is proxied through. Every version up to and including 11.5.0 is affected; 11.6.0 contains the fix.

Vendor scored this CVSS 10.0 Critical with Scope:Changed, C:H/I:H — reasoning that the flaw in the proxy directly compromises a separate upstream security zone. That framing is defensible for the worst-case deployment (a proxy fronting an unauthenticated internal admin API), but it treats every install as that worst case. In real fleets @fastify/http-proxy is often a routing convenience in front of already-authenticated services, and there is no RCE, no data destruction, and no lateral movement primitive on its own — the blast radius is *whatever the upstream chose to hide behind the prefix*. That is a HIGH, not a universal 10.

Why this verdict

• Trivial exploitation: unauthenticated, network-reachable, one crafted URL. AC:L/PR:N/UI:N is accurate — this is the easiest possible bug to fire.
• Conditional impact: the actual damage requires the upstream to have delegated path-based authz to the proxy. Many mature deployments authenticate independently at the upstream — those installs see zero material impact.
• Role multiplier — API gateway in front of unauthenticated internal admin API: chain succeeds, blast radius is tenant-scale data / admin-action exposure. Plausible in perhaps 10–25% of @fastify/http-proxy installs given the library's ergonomics encourage exactly this pattern. Floor stays at HIGH.
• Role multiplier — proxy fronting a fully-authenticated upstream (JWT/session at backend): chain reaches new paths but hits auth walls. Blast radius = information disclosure at most.
• Role multiplier — hobby / low-traffic sites: irrelevant.
• No supply-chain or fleet-wide amplifier: this is a per-service bug, not a domain/PKI/EDR/CI compromise vector. That's the reason CRITICAL is not the floor.
• Upstream WAF / CDN often neutralizes: Cloudflare, CloudFront, Akamai, and default nginx configs normalize %61→a before Fastify sees it, silently killing the attack for a large fraction of internet-exposed instances.

Why not higher?

Not CRITICAL because @fastify/http-proxy is not canonically a high-value-role component (it's not an IdP, hypervisor, CA, backup, or kernel-mode agent), and the deployment share where the chain ends in fleet-scale or supply-chain compromise is not ≥10%. The CVSS 10.0 assumes universal Scope:Changed catastrophic impact; real installs vary from 'no impact' to 'tenant admin access' depending on upstream authz.

Why not lower?

Not MEDIUM because when the vulnerable pattern *is* present, the attack is unauthenticated, one-request, no user interaction, and directly yields access to intentionally-hidden endpoints. Same-day advisory PoC means weaponization is measured in hours, and downgrading below HIGH would fail teams whose gateways trust rewritePrefix — a non-trivial minority.

1. Upgrade @fastify/http-proxy to ≥ 11.6.0 — Only real fix. Bump the dependency, run integration tests against your prefix routes, redeploy. For a HIGH verdict noisgate mandates rollout within 30 days; if the proxy is internet-exposed AND fronts an admin API, treat as CRITICAL and roll within 3 days.
2. Front the proxy with a normalizing edge (nginx, Cloudflare, CloudFront) — Configure the edge to decode and re-canonicalize the request path before forwarding to Fastify. In nginx, this is default behavior for the location URI; verify with curl --path-as-is against staging. Deploy within 30 days as a defense-in-depth belt-and-suspenders even after patching.
3. Enforce authn/authz at the upstream, not at the proxy prefix — Architectural fix — if /admin requires being authenticated at the upstream, no prefix bypass matters. Treat rewritePrefix as *routing*, never as *authorization*. Do this alongside the patch, tracked as a hardening item within 30 days.
4. Add SIEM alert for upstream requests outside the expected prefix scope — The upstream sees the proxy's identity as the client. Alert on any request whose path does not begin with the intended rewritePrefix target — this catches both this CVE and any future prefix-bypass regression. Deploy within 30 days.
5. SBOM sweep for fastify-http-proxy (pre-scope) and @fastify/http-proxy (post-scope) — The package was renamed during the npm-scoped migration; both names exist in older lockfiles. Use npm ls @fastify/http-proxy fastify-http-proxy or your SCA (Snyk, Dependabot, Renovate) across all 10k hosts within 30 days.

Run on any host or CI runner with Node/npm project checkouts. From the project root, invoke ./check-fastify-http-proxy.sh . (or a path to a directory to scan recursively for package-lock.json / pnpm-lock.yaml / yarn.lock). No elevated privileges required — just read access to the lockfiles.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-16117 @fastify/http-proxy prefix escape
# Usage: ./check-fastify-http-proxy.sh <path-to-scan>
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
ROOT="${1:-.}"
FIXED_MAJOR=11
FIXED_MINOR=6
FIXED_PATCH=0
STATUS="UNKNOWN"
FOUND=0

ver_ge() {
  # returns 0 if $1 >= FIXED
  local v="$1"
  local maj min pat
  IFS='.' read -r maj min pat <<< "$v"
  maj=${maj:-0}; min=${min:-0}; pat=${pat%%[!0-9]*}; pat=${pat:-0}
  if   (( maj > FIXED_MAJOR )); then return 0
  elif (( maj < FIXED_MAJOR )); then return 1
  elif (( min > FIXED_MINOR )); then return 0
  elif (( min < FIXED_MINOR )); then return 1
  elif (( pat >= FIXED_PATCH )); then return 0
  else return 1
  fi
}

scan_lockfile() {
  local f="$1"
  # Match both scoped (@fastify/http-proxy) and legacy (fastify-http-proxy)
  local versions
  versions=$(grep -Eo '"(@fastify/http-proxy|fastify-http-proxy)"[^{]*"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' "$f" 2>/dev/null \
    | grep -Eo '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' \
    | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
  # yarn.lock style
  local yv
  yv=$(grep -E '^("?@?fastify[/-]http-proxy)' -A2 "$f" 2>/dev/null | grep -Eo 'version "[0-9]+\.[0-9]+\.[0-9]+"' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
  versions="$versions"$'\n'"$yv"
  while IFS= read -r v; do
    [ -z "$v" ] && continue
    FOUND=1
    if ver_ge "$v"; then
      echo "[OK]   $f -> @fastify/http-proxy $v (>= 11.6.0)"
    else
      echo "[VULN] $f -> @fastify/http-proxy $v (< 11.6.0 — CVE-2026-16117)"
      STATUS="VULNERABLE"
    fi
  done <<< "$versions"
}

while IFS= read -r -d '' lock; do
  scan_lockfile "$lock"
done < <(find "$ROOT" -type f \( -name package-lock.json -o -name pnpm-lock.yaml -o -name yarn.lock -o -name npm-shrinkwrap.json \) -print0 2>/dev/null)

if [ "$STATUS" = "VULNERABLE" ]; then
  echo "RESULT: VULNERABLE"; exit 1
fi
if [ $FOUND -eq 1 ]; then
  echo "RESULT: PATCHED"; exit 0
fi
echo "RESULT: UNKNOWN (no @fastify/http-proxy references found under $ROOT)"
exit 2

Sources

1. GitHub Security Advisory GHSA-mx7v-qhg9-2mvv
2. fastify/fastify-http-proxy repository
3. Prior related advisory GHSA-c4qr-gmr9-v23w (CVE-2021-21322)
4. OpenJS Foundation CNA advisories
5. Snyk — fastify-http-proxy package
6. OpenCVE — Fastify vendor listing
7. CISA Vulnerability Summary (week of 2026-06-29)
8. NorthIT prior-art writeup on fastify-http-proxy prefix escape