Critical· 10official fix available
CVE-2026-16117
A flaw in the @fastify/http-proxy library allows attackers to bypass security rules meant to hide specific web paths. This happens because the proxy fails to correctly handle URL-encoded characters when rewriting request paths.
publishedJul 18, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
10
critical · how bad it is
exploitation · epss
<1%
19th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 1, 2026
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
01
Who is affected
Users of @fastify/http-proxy versions up to and including 11.5.0.
02
Real-world impact
An attacker could access sensitive or administrative endpoints on an internal server that were intended to be hidden by the proxy.
03
Why this severity
This is a critical vulnerability because it can be exploited remotely over the network without any user interaction or authentication, allowing an attacker to bypass security controls.
04
What to do about it
official fix available
recommended steps
- 01upgrade to @fastify/http-proxy 11.6.0
NVD description
05
Timeline
- Jul 18, 2026 · 15d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07
References & advisories
- cna.openjsf.org/security-advisories.htmlvendor advisory
- github.com/fastify/fastify-http-proxy/…vendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →