CVE-2026-15631 Overview
CVE-2026-15631 is a path traversal vulnerability [CWE-22] affecting @fastify/http-proxy versions 9.4.0 through 11.5.0. The library fails to validate resolved WebSocket destination paths against the configured rewrite prefix. Attackers can craft WebSocket upgrade requests containing dot-segment sequences to escape the rewrite prefix and reach upstream endpoints not intended for proxy exposure. This flaw is a WebSocket variant of CVE-2021-21322, in a code path that never received the HTTP-side fix applied to fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize paths before transmission.
Critical Impact
Remote unauthenticated attackers can bypass proxy routing controls and access upstream WebSocket endpoints, leading to confidentiality and integrity loss on internal services.
Affected Products
- @fastify/http-proxy version 9.4.0
- @fastify/http-proxy versions 9.4.0 through 11.5.0
- Applications embedding vulnerable @fastify/http-proxy releases as a WebSocket reverse proxy
Discovery Timeline
- 2026-07-18 - CVE-2026-15631 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-15631
Vulnerability Analysis
The vulnerability resides in WebSocketProxy.findUpstream, the routing function responsible for resolving the upstream target of an incoming WebSocket upgrade request. The function constructs the destination URL using the WHATWG URL constructor, which automatically collapses dot segments such as .. and . during parsing.
Because the resolved path is never re-validated against the configured rewritePrefix, a crafted upgrade request with traversal sequences produces a normalized upstream path that falls outside the intended prefix boundary. The proxy then forwards the WebSocket handshake to an internal endpoint that was never meant to be exposed.
The issue is scoped to WebSocket routing. The equivalent HTTP path was previously hardened in fastify/reply-from following CVE-2021-21322, but that fix was not propagated to the WebSocket handler.
Root Cause
The root cause is missing post-normalization validation. WebSocketProxy.findUpstream trusts the output of the WHATWG URL constructor without confirming that the resolved path still begins with the configured rewrite prefix. Dot-segment collapsing therefore functions as a path-boundary bypass.
Attack Vector
An unauthenticated remote attacker sends a WebSocket upgrade request whose request target contains traversal sequences, for example a path constructed to walk out of the proxied prefix and into a sibling upstream route. Standards-compliant clients such as browsers and the ws Node.js library normalize the target before sending, which neutralizes the payload. Exploitation therefore requires a raw HTTP client, a custom WebSocket implementation, or a downstream proxy that forwards the request target unchanged. Such topologies are common in production service meshes and load-balanced environments.
Refer to the GitHub Security Advisory GHSA-7hrw-592w-9wh2 for the coordinated technical write-up.
Detection Methods for CVE-2026-15631
Indicators of Compromise
- WebSocket Upgrade requests containing .., %2e%2e, or encoded dot-segment variants in the request target.
- Access log entries showing successful WebSocket handshakes on upstream routes that are not published through the proxy configuration.
- Unexpected long-lived WebSocket sessions terminating at internal services behind the Fastify proxy layer.
Detection Strategies
- Inspect reverse proxy and application access logs for HTTP 101 Switching Protocols responses correlated with traversal sequences in the URI.
- Compare the pre-normalized request path with the upstream target selected by the proxy and alert on divergence beyond the configured rewrite prefix.
- Deploy application-layer rules on WAFs or ingress controllers to flag WebSocket upgrade requests whose paths do not canonically match a whitelisted prefix.
Monitoring Recommendations
- Enable verbose request logging on @fastify/http-proxy instances to capture both the original and rewritten paths for each upgrade.
- Forward proxy and upstream logs to a centralized analytics pipeline and build correlation queries for path traversal patterns in Upgrade: websocket transactions.
- Track the version inventory of @fastify/http-proxy across all Node.js services using software composition analysis and alert on any instance below 11.6.0.
How to Mitigate CVE-2026-15631
Immediate Actions Required
- Upgrade @fastify/http-proxy to version 11.6.0 in all Node.js services that expose WebSocket routes.
- Audit deployed topologies for downstream proxies or custom clients that forward request targets without normalization, since these components make exploitation reachable.
- Restrict network reachability of upstream WebSocket endpoints so they are only callable through the intended proxy prefix.
Patch Information
The maintainers released @fastify/http-proxy11.6.0, which adds validation of the resolved WebSocket destination path against the configured rewritePrefix before forwarding the upgrade. See the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-7hrw-592w-9wh2 for full patch details.
Workarounds
- No official workarounds are available. Upgrading to @fastify/http-proxy11.6.0 is the only supported remediation.
- As a defense-in-depth measure, enforce path normalization and prefix validation at an upstream ingress or WAF before requests reach the Fastify proxy.
# Upgrade to the patched release
npm install @fastify/http-proxy@11.6.0
# Verify the installed version
npm ls @fastify/http-proxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
