CVE WATCH / VULNERABILITY DETAIL
CVE-2026-120214
MEDIUMCVSS 5.9NVD feed
Published 2 November 2026 · tracked since 2 November 2026
Description
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog