URL-Encoded Prefix Bypass in Fastify HTTP Proxy

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefix therefore matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged. The upstream then decodes the path and serves it, letting an attacker reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability affects @fastify/http-proxy versions up to 11.5.0, where URL-encoded characters in request paths bypass the intended prefix-rewriting mechanism. When a client sends a request with encoded characters matching the configured prefix, Fastify's router correctly decodes the path for route matching, but the prefix-rewrite logic fails to account for this encoding difference. The raw encoded path then gets forwarded to upstream servers without modification, potentially exposing internal routing logic, enabling path traversal attacks, or allowing attackers to access unintended backend resources. This affects any organization running vulnerable Fastify proxy deployments that rely on prefix rewriting for security boundaries or request routing.

Casky's 322 mapped skills leverage Claude AI's reasoning capabilities to detect the attack patterns behind this vulnerability by analyzing MITRE ATT&CK technique TA0001 (Reconnaissance) and TA0043 (Reconnaissance via HTTP) behaviors. Practitioners would see findings correlating suspicious URL-encoded path segments in HTTP requests that successfully bypass routing controls, combined with anomalous upstream requests showing decoded paths diverging from the original client request. The platform would flag cases where identical route matches occur with varying encoding patterns, revealing the literal string-matching weakness. Additionally, Casky's skills would identify reconnaissance attempts probing for encoded bypass patterns (like %2F for forward slashes) followed by attempts to access restricted paths, helping teams distinguish legitimate traffic from exploitation activity in their logs and network telemetry.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16117.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16117

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16117. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn