CVE-2026-120213

{
  "etk_id": "ETK-2026-3275",
  "cve_id": "CVE-2026-120213",
  "display_id": "CVE-2026-120213",
  "ghsa_id": "GHSA-h3vp-4jfr-v364",
  "euvd_id": "EUVD-2026-115117",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path-restriction bypass in @fastify/http-proxy",
  "summary": "@fastify/http-proxy versions 9.0.0 through 11.6.5 can mishandle decoded route parameters when applications use parameterized prefix and rewritePrefix settings. An unauthenticated attacker may cause requests to reach upstream paths outside the intended restriction, potentially enabling SSRF or bypassing upstream authorization controls.",
  "mitigation": "Upgrade @fastify/http-proxy to version 11.6.6 or later. Prioritize deployments that use parameterized prefix and rewritePrefix settings to constrain upstream paths.",
  "vendor": "@fastify/http-proxy",
  "product": "@fastify/http-proxy",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.0.0, < 11.6.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "11.6.6"
      ],
      "package_name": "@fastify/http-proxy",
      "purl": "pkg:npm/@fastify/http-proxy"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.2662223,
  "t0_at": "2026-11-02T10:15:08.777000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T10:15:08.777000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T10:15:08.777000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120213"
    }
  }
}