CyberRota Analysis
AI-GeneratedVersions of @fastify/http-proxy up to and including 11.5.0 are vulnerable due to improper handling of URL-encoded request prefixes, allowing attackers to bypass prefix rewrites and access restricted upstream paths. This critical vulnerability can lead to exposure of internal or administrative endpoints, posing significant risks to application security. Organizations using affected versions should prioritize upgrading to version 11.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.
Related CVEs
Other vulnerabilities affecting the same vendor(s)