@fastify/http-proxy Path-Restriction Bypass Vulnerability

@fastify/http-proxy, a Fastify plugin for proxying HTTP requests, contains a path-restriction bypass vulnerability affecting versions 9.0.0 through 11.6.5.

When applications use parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator and fragment/query delimiter can decode into real separators, injecting extra upstream path segments and stripping the mandatory suffix.

An unauthenticated remote attacker can exploit this to reach upstream locations outside the intended prefix, potentially leading to server-side request forgery or authorization bypass in the proxied service.

• Affected versions: 9.0.0 through 11.6.5
• Fixed in: 11.6.6
• No workaround available; upgrade required.