CVE-2026-16117
CWE-20Published: July 18, 2026· Updated: Jul 18, 2026
Official Description
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.
Patches: upgrade to @fastify/http-proxy 11.6.0.
Workarounds: none.
Risk Analysis
This critical vulnerability in @fastify/http-proxy allows an attacker to bypass configured proxy rewrite rules. By URL-encoding parts of the request prefix, an attacker can access internal or administrative endpoints that the proxy was intended to hide. The CVSS score of 10.0 indicates maximum severity and a high potential for impact.
No public exploit is known for this remotely exploitable vulnerability. The low attack complexity means it could be easily exploited if a working exploit were to emerge.
To mitigate this vulnerability, upgrade @fastify/http-proxy to version 11.6.0. There are no known workarounds for this issue.
Technical Analysis
CVE-2026-16117 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-20)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-16117 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts