@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
Published Sep 3, 2026
7.5
HIGHCVSS 3.1
EPSS 0.74%
Description
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later.
Affected products
No data.
- < 11.6.2
No data.
Red Hat OpenShift AI (RHOAI)
rhoai/odh-core-bff-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-operator-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-agent-ops-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-automl-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-autorag-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-eval-hub-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-gen-ai-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-maas-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-mlflow-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-model-registry-rhel9
Affected
Red Hat OpenShift Dev Spaces
devspaces/dashboard-rhel9
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-core-bff-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-operator-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-agent-ops-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-automl-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-autorag-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-eval-hub-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-maas-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-mlflow-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/dashboard-rhel9 | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This Important flaw in `@fastify/http-proxy` allows an unauthenticated network attacker to bypass proxy path validation using backslash dot-segments. This can lead to information disclosure by enabling access to internal endpoints that should be protected by the proxy, impacting the confidentiality of sensitive data within affected Red Hat products.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (7)
- https://access.redhat.com/security/cve/CVE-2026-85124 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2527955 Issue Tracking
- https://cna.openjsf.org/security-advisories.html Third Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70381 Advisory
- https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85124
- https://www.cve.org/CVERecord?id=CVE-2026-85124
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-85124 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2527955 | Issue Tracking | |
| https://cna.openjsf.org/security-advisories.html | Third Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70381 | Advisory | |
| https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-qv33-689p-2xq5 | Vendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-85124 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-85124 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data