CVE-2026-85124

Executive Summary

CVE-2026-85124 is a path traversal vulnerability (CWE-22) in the @fastify/http-proxy Node.js package affecting all versions before 11.6.2. The plain HTTP request handler fails to validate backslash-based dot-segments in proxied request paths before forwarding them to the configured upstream, while the WebSocket code path performs this validation correctly. Because the underlying reply-from library only rejects forward-slash traversal, an unauthenticated remote attacker can craft requests with backslash dot-segments that escape the prefix and rewritePrefix boundaries and reach internal upstream endpoints that should remain hidden behind the proxy. Successful exploitation results in disclosure of internal endpoints (confidentiality impact rated High; no integrity or availability impact).

Technical Analysis

The vulnerability resides in @fastify/http-proxy, a Fastify plugin that reverse-proxies incoming HTTP requests to a configured upstream service. Administrators use the prefix and rewritePrefix options to expose only a bounded set of upstream paths — for example, mapping an externally visible /api/ prefix onto an internal upstream base path while keeping other internal routes unexposed.

The core defect is an asymmetry between the HTTP and WebSocket handlers:

• The WebSocket path performs destination validation on the request path before it is forwarded upstream. This validation is intended to prevent traversal sequences from rewriting the proxied destination outside the intended boundary.
• The plain HTTP request handler skips this destination validation entirely. It delegates path handling to the underlying reply-from library.
• The reply-from library, however, only rejects forward-slash traversal (/-based dot-segments such as ../). It does not normalize or reject backslash-based dot-segments (\).

As a result, a request containing backslash dot-segments is not caught by either layer of validation, yet is still interpreted as directory traversal by the upstream server or by path normalization logic downstream of the proxy. This allows the request to escape the boundary established by the prefix and rewritePrefix options and reach upstream paths that were intended to stay hidden behind the proxy.

This is a classic canonicalization mismatch: two components (the proxy plugin and the reply-from library, and potentially the upstream server) disagree about which characters delimit path segments. Because backslash is treated as a path separator by some servers and normalization routines (notably on Windows-hosted upstreams and certain URL parsers), the traversal succeeds where forward-slash-only filtering fails.

The attack requires no authentication (PR:N), no user interaction (UI:N), and is network-reachable (AV:N) with low complexity (AC:L). The scope is unchanged (S:U) because the impact is confined to the proxy/upstream security authority, and the sole impact is to confidentiality (C:H) — disclosure of internal upstream endpoints. There is no demonstrated integrity or availability impact (I:N/A:N), consistent with a read-oriented discovery of hidden endpoints rather than direct manipulation or denial-of-service.

No specific function names, class names, or file paths beyond those named in the vendor description (prefix, rewritePrefix, reply-from) are asserted here, because the advisory does not disclose them.

Exploitation Scenarios

Important note on sourcing: The vendor description confirms a public proof-of-concept exists (POC_STATUS: Public), but no exploit code or Nuclei template is available in the provided dataset. The chain below is described strictly at the vulnerability-class level consistent with the advisory. No specific function names, endpoints, or payload strings beyond those in the advisory are invented.

1. Reconnaissance / target identification. An attacker scans the internet or an internal network for services running Fastify with the @fastify/http-proxy plugin. Externally observable signals include x-powered-by: fastify response headers, Fastify-specific error pages, and the presence of reverse-proxied endpoints whose prefix mapping is evident from URL structure. The attacker identifies a proxy that forwards a bounded public prefix (e.g., a documented /api/ or /public/ route) to an internal upstream, and infers that other internal paths exist behind the same upstream.

2. Triggering the flaw class. Path traversal (CWE-22) is triggered by supplying a request path that contains backslash dot-segments. Because the plain HTTP handler does not run the destination validation that the WebSocket handler performs, and because reply-from only rejects forward-slash traversal, the backslash-form sequence survives the proxy's checks. The request is forwarded upstream where backslash is interpreted as a segment separator, causing the resolved upstream path to fall outside the prefix/rewritePrefix boundary.

3. Payload / execution method (vulnerability-class level). The attacker sends a crafted HTTP request targeting the proxy with a path that embeds backslash traversal sequences designed to climb out of the configured prefix. Success is observable when the upstream responds with content from an internal path that is not normally reachable through the proxy mapping. The exact encoding depends on the deployment, but the mechanism is: backslash dot-segments bypass both the plugin's HTTP-path validation and reply-from's forward-slash-only filter. No specific payload string is asserted because none is published in the dataset.

4. Post-exploitation impact. The practical outcome is disclosure of internal endpoints — the attacker can enumerate and read responses from upstream paths hidden behind the proxy boundary. This enables mapping of the internal API surface, discovery of administrative, diagnostic, or internal-only routes, and potential exposure of sensitive metadata returned by those routes. Because the CVSS vector shows only confidentiality impact, the report does not claim direct data modification or service disruption.

Impact Assessment

CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV:N — Network): Exploitable remotely across a network boundary; no local access required.
• Attack Complexity (AC:L — Low): No specialized conditions or race windows are described; a crafted request suffices.
• Privileges Required (PR:N — None): The advisory explicitly states the attacker is unauthenticated.
• User Interaction (UI:N — None): No victim action needed.
• Scope (S:U — Unchanged): Impact stays within the proxy/upstream security authority.
• Confidentiality (C:H — High): Internal endpoints intended to be hidden can be disclosed.
• Integrity (I:N) / Availability (A:N): No integrity or availability impact described.

Business impact: Organizations that deploy @fastify/http-proxy as a security boundary — to expose a limited public surface while shielding internal APIs — are directly affected. The vulnerability undermines the assumption that prefix/rewritePrefix constrain reachability. Exposed internal endpoints may leak configuration, internal identifiers, diagnostics, or other sensitive metadata. Because the flaw requires no authentication, any internet-exposed Fastify proxy instance running an affected version is a candidate target.

Blast radius: Every deployment of @fastify/http-proxy below 11.6.2 that relies on prefix bounding to hide upstream paths. The full affected-version range is confirmed as all versions before 11.6.2. EPSS is 0.00552 (44.3rd percentile) — a moderate near-term exploitation probability, consistent with a public PoC but no observed mass exploitation. CISA KEV status: NO — no confirmed in-the-wild exploitation at time of writing.

Detection Guidance

Detection focuses on anomalous request paths containing backslash traversal sequences (\ combined with dot-segments) reaching the proxy, and on upstream responses returned for paths outside the expected prefix boundary.

Sigma Rule

title: Fastify HTTP-Proxy Backslash Path Traversal Attempt (CVE-2026-85124)
id: 8f3a1c2e-7b64-4d9a-9c1f-2b6e5a0d4f77
status: experimental
description: Detects HTTP requests containing backslash-based dot-segments indicative of CVE-2026-85124 path traversal against @fastify/http-proxy.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_backslash:
    cs-uri-query|contains:
      - '\..'
      - '..\'
      - '\%2e%2e'
      - '%5c..'
      - '%5c%2e%2e'
  selection_method:
    cs-method:
      - GET
      - POST
      - HEAD
  condition: selection_backslash and selection_method
falsepositives:
  - Legitimate applications that intentionally use backslashes in paths (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.85124

YARA Rule

rule CVE_2026_85124_Fastify_Backslash_Traversal
{
    meta:
        description = "Detects backslash-based path traversal attempts targeting @fastify/http-proxy (CVE-2026-85124)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85124"
        cve = "CVE-2026-85124"

    strings:
        $bs_dot1 = "\\.." ascii wide nocase
        $bs_dot2 = "..\\" ascii wide nocase
        $enc_bs1 = "%5c%2e%2e" ascii nocase
        $enc_bs2 = "%5c.." ascii nocase
        $fwdslash = "../" ascii nocase

    condition:
        (any of ($bs_dot1, $bs_dot2, $enc_bs1, $enc_bs2)) and
        not $fwdslash
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85124 Fastify http-proxy backslash path traversal attempt"; flow:established,to_server; http.uri; content:"\\"; http.uri; content:".."; within:8; classtype:attempted-recon; reference:cve,2026-85124; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85124; sid:202685124; rev:1;)

alert http any any -> any any (msg:"CVE-2026-85124 Fastify http-proxy encoded backslash traversal"; flow:established,to_server; http.uri; content:"%5c"; nocase; http.uri; content:"%2e"; nocase; within:12; classtype:attempted-recon; reference:cve,2026-85124; sid:202685125; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST","HEAD")
      and wildcard(http.request.uri, "*\\\\..*") ]
  [ network where http.response.status_code == 200
      and http.request.uri != null ]

Note: In EQL strings, backslashes must be escaped; the pattern matches a literal backslash followed by dot-segment characters in the request URI, followed by a successful (200) response indicating possible traversal success.

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=fastify
| eval uri=coalesce(uri, url, request_path)
| where match(uri, "(?i)(\\\\.\\.)|(%5c%\\.?2e)|(%5c\\.\\.)")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as sample_uris by src_ip, dest, status
| where status=200 OR count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,fastify,cve-2026-85124,">
  <rule id="100851" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\\\.\.|%5c%2e%2e|%5c\.\.</field>
    <description>CVE-2026-85124: Backslash path traversal attempt against Fastify http-proxy</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85124,path_traversal,</group>
  </rule>

  <rule id="100852" level="12">
    <if_sid>100851</if_sid>
    <field name="id">^200$</field>
    <description>CVE-2026-85124: Possible SUCCESSFUL traversal - 200 response to backslash traversal attempt</description>
    <group>cve_2026_85124,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY. Two independent sources (NVD and OSV) confirm the fix. No vendor-published advisory or workaround is present in the provided dataset; no affected-version list is enumerated beyond the upstream range.

1. Immediate mitigations

   • Upgrade @fastify/http-proxy to 11.6.2 or later — the only reliable fix, since the patch addresses the missing HTTP-path validation and the backslash gap.
   • Where immediate upgrade is not possible, enforce path normalization and rejection of backslash dot-segments at a fronting reverse proxy, WAF, or load balancer before requests reach the Fastify proxy, so that crafted paths never reach the vulnerable handler.
   • Restrict network access to the proxy and its upstream so that only intended clients can reach the prefix-bounded surface (defense in depth).
   • Audit upstream services to ensure they do not treat backslash as a path separator, reducing the chance that a forwarded backslash segment traverses on the upstream side.

2. Patch / upgrade steps

   • Inspect dependency trees (npm ls @fastify/http-proxy, lockfile review) to identify all transitive and direct usages.
   • Pin or update to @fastify/http-proxy@^11.6.2 (or the latest release) and rebuild/roll containers.
   • Verify in staging that WebSocket and HTTP proxy behavior remain correct after the upgrade.
   • Re-scan SBOMs and image layers to confirm no residual vulnerable copies remain.

3. Long-term hardening

   • Treat the proxy layer as defense in depth, not as the sole authorization boundary; enforce authentication/authorization on the upstream itself.
   • Adopt strict, centralized path canonicalization and reject any request containing ambiguous separators or dot-segments before proxying.
   • Maintain continuous dependency scanning and subscribe to Fastify/OSV advisories; integrate into CI so affected versions are caught pre-deployment.
   • Log and alert on traversal-shaped request paths (see Detection Guidance) to catch exploitation attempts early.

References

1. NVD — CVE-2026-85124: https://nvd.nist.gov/vuln/detail/CVE-2026-85124
2. OSV — @fastify/http-proxy advisory (confirms fixed version 11.6.2): https://osv.dev/
3. @fastify/http-proxy package / changelog (upgrade to 11.6.2 or later): https://www.npmjs.com/package/@fastify/http-proxy
4. MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85124 not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: No confirmed exploitation in the wild and no CISA KEV listing are reported in the provided dataset. A public proof-of-concept is noted, but no exploit code or Nuclei template is available in this dataset, and no named threat-actor campaign is associated with this CVE. EPSS 0.00552 (44.3rd percentile) indicates a moderate, not-yet-weaponized exploitation outlook. Monitoring is warranted given the unauthenticated, low-complexity nature of the flaw.