Path Traversal via Unencoded URL Parameters in Fastify Proxy

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. Th

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The @fastify/http-proxy plugin contains a critical path traversal vulnerability affecting versions 9.0.0 through 11.6.5. When applications use parameterized prefix and rewritePrefix options, the plugin fails to re-encode URL-decoded route parameters before substituting them into the rewrite prefix. This allows attackers to inject path separators, fragments, and query delimiters through specially crafted parameter values, enabling unauthorized access to backend resources outside the intended proxy scope. Any organization running affected Fastify versions with dynamic proxy routing is vulnerable, particularly those proxying requests to sensitive backend services where path-based access controls are relied upon for security boundaries.

Casky's 351 mapped skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners will observe findings correlating CWE-22 (Path Traversal) and CWE-436 (Interpretation Conflict) signatures, with Claude's extended reasoning identifying sequences where URL parameters containing encoded path traversal sequences (e.g., %2f%2e%2e%2fsensitiive-endpoint) flow through proxy rewrite logic without sanitization. Detection telemetry will reveal suspicious request patterns where decoded segments alter the intended upstream path, backend access logs showing unexpected resource requests, and resource enumeration attempts targeting paths outside configured proxy prefixes—all hallmarks of Discovery and lateral movement following successful parameter injection.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120213.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-120213

Casky has 351 skills that investigate the attack patterns behind CVE-2026-120213. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn