CVE-2026-16117: Fastify HTTP Proxy Path Traversal Flaw

CVE-2026-16117 Overview

CVE-2026-16117 is a critical input validation flaw ([CWE-20]) affecting @fastify/http-proxy versions up to and including 11.5.0. The vulnerability allows attackers to bypass the rewritePrefix configuration by URL-encoding characters in the request path. Fastify's router decodes paths for route matching, but request.url retains the encoded form. The prefix-rewrite step performs a literal string replacement against the decoded prefix, so encoded requests match the route yet skip the rewrite. Attackers can reach upstream paths intended to be hidden, including internal and administrative endpoints.

Critical Impact
Remote unauthenticated attackers can access protected upstream endpoints by URL-encoding prefix characters, defeating the proxy's path isolation.

Affected Products

@fastify/http-proxy versions <= 11.5.0
Node.js applications using Fastify with rewritePrefix for upstream path isolation
Services relying on @fastify/http-proxy to hide administrative or internal routes

Discovery Timeline

2026-07-18 - CVE-2026-16117 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16117

Vulnerability Analysis

The flaw resides in how @fastify/http-proxy handles the interaction between Fastify's router and its prefix-rewrite logic. Fastify URL-decodes incoming paths when performing route matching, so a request to /%61pi/admin matches a route registered under /api. However, the plugin's prefix-rewrite step operates on request.url, which retains the original encoded form. The rewrite uses a literal string replacement against the decoded prefix value, so the encoded segment does not match and the replacement is skipped.

The raw, unmodified encoded path is then forwarded to the upstream service. The upstream server decodes the path normally and serves the requested resource. This defeats the security boundary that rewritePrefix was configured to enforce.

Root Cause

The root cause is inconsistent path normalization between two components. Route matching operates on decoded input, while prefix rewriting operates on encoded input using literal string comparison. This encoding mismatch allows a single request to satisfy the routing predicate without triggering the prefix substitution.

Attack Vector

An unauthenticated remote attacker crafts a request where one or more characters of the configured prefix are percent-encoded. For example, if the proxy hides /internal/* behind a public prefix, encoding a character such as /%69nternal/admin allows the request to bypass rewrite while still routing correctly. The upstream service receives the encoded path, decodes it, and serves the internal resource. See the GitHub Security Advisory GHSA-mx7v-qhg9-2mvv for technical details.

Detection Methods for CVE-2026-16117

Indicators of Compromise

HTTP access logs showing percent-encoded characters within the configured proxy prefix path segment
Upstream service logs showing requests to internal or administrative endpoints originating from the proxy that should have been rewritten
Mismatches between the proxy's inbound request.url and the upstream's received path

Detection Strategies

Compare inbound proxy request paths against upstream-received paths, alerting on any request where encoded characters appear in the prefix segment
Inspect application logs for HTTP requests containing % sequences in path segments that correspond to routing prefixes
Audit reverse proxy and Web Application Firewall (WAF) telemetry for anomalous access to administrative routes not exposed via the documented public API

Monitoring Recommendations

Enable verbose access logging on both @fastify/http-proxy and upstream services to correlate rewrite behavior
Baseline normal encoded-character usage in production traffic and alert on deviations
Monitor for spikes in 4xx and 5xx responses from upstream administrative endpoints, which may indicate probing activity

How to Mitigate CVE-2026-16117

Immediate Actions Required

Upgrade @fastify/http-proxy to version 11.6.0 or later across all Node.js services
Inventory all Fastify deployments using the rewritePrefix option and confirm patched versions are running
Review upstream service access logs for evidence of prior exploitation attempts using encoded prefix paths

Patch Information

Upgrade to @fastify/http-proxy11.6.0, which corrects the prefix-rewrite logic to handle URL-encoded paths consistently with the router's decoding behavior. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-mx7v-qhg9-2mvv for release details.

Workarounds

No official workarounds are available; upgrading is the only supported remediation
As a defense-in-depth measure, enforce authentication on upstream administrative endpoints so path isolation is not the sole security boundary
Consider adding a WAF rule that rejects requests containing percent-encoded characters within known proxy prefix segments until patching is complete

bash

# Configuration example: upgrade the vulnerable package
npm install @fastify/http-proxy@^11.6.0

# Verify the installed version
npm ls @fastify/http-proxy