Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15631— @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

CVSS 8.7 · High EPSS 0.30% · P22

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProductVersion RangeStatus
@fastify/http-proxy@fastify/http-proxy9.4.0< 11.6.0affected
11.6.0unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-15631

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite prefix and reach upstream endpoints that were not meant to be exposed by the proxy. This is a variant of CVE-2021-21322 in a code path that never went through the HTTP fix in fastify/reply-from. Exploitation requires a non-normalizing WebSocket client, since browsers and the ws package normalize the request path before sending, but raw HTTP clients or downstream proxies that forward the request target unchanged make the attack reachable in production topologies. Patches: upgrade to @fastify/http-proxy 11.6.0. Workarounds: none.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Fastify @fastify/http-proxy 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fastify @fastify/http-proxy是Fastify团队的一个HTTP代理模块。 Fastify @fastify/http-proxy 9.4.0版本至11.5.0版本存在路径遍历漏洞，该漏洞源于未验证解析的WebSocket目标路径与配置的重写前缀，可能导致路径遍历攻击，从而绕过重写前缀并访问不应暴露的上游端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
@fastify/http-proxy@fastify/http-proxy 9.4.0 ~ 11.6.0 -

II. Public POCs for CVE-2026-15631

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8328 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-15631

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-15631 (1)

IV. Related Vulnerabilities

Same product: @fastify/http-proxy
Same vendor: @fastify/http-proxy
Same weakness: CWE-22

V. Comments for CVE-2026-15631

No comments yet

Leave a comment