CVE-2026-120213

Published 2 November 2026 · tracked since 2 November 2026

Description

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded ro

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-120428 MEDIUM 6.1
• CVE-2026-120318 HIGH 7.2
• CVE-2026-109083
• CVE-2026-110535
• CVE-2026-111959
• CVE-2026-113511
• CVE-2026-113687
• CVE-2026-114364
• CVE-2026-102802
• CVE-2026-103419

→ Open the live CVE board · all tools