Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-16117

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
Back to all
CVE

CVE-2026-16117

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.

Patches: upgrade to @fastify/http-proxy 11.6.0.

Workarounds: none.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
10
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
C
H
U
-

Related Resources

No items found.

References

https://cna.openjsf.org/security-advisories.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16117.json, https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-mx7v-qhg9-2mvv, https://nvd.nist.gov/vuln/detail/CVE-2026-16117

Severity

10

CVSS Score
0
10

Basic Information

Base CVSS
10
EPSS Probability
0.00444%
EPSS Percentile
0.37466%
Introduced Version
0
Fix Available
7f90c4128ad0b2066333a41a8e07699b729e9f0f

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading