What is CVE-2026-120213 in @fastify/http-proxy?
The vulnerability tracked as CVE-2026-120213 is a critical security flaw affecting the Rust zip library vulnerability and similar ecosystem components, specifically residing in the @fastify/http-proxy plugin. It carries a CVSS score of 9.1, making it a severe risk for web architectures.
The issue arises when applications use parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path. The plugin substitutes URL-decoded route parameters directly into rewritePrefix without re-encoding them properly.
Who is affected by this path restriction bypass?
This flaw impacts all deployments utilizing versions 9.0.0 through 11.6.5 of the @fastify/http-proxy plugin. Unauthenticated remote attackers can exploit this weakness, much like other credential exposures such as Kaniko critical CVE-2026-105769 flaw, without needing dot-dot traversal techniques.
By sending a parameter value that encodes a path separator together with a query or fragment delimiter, attackers inject extra upstream path segments and strip mandatory suffixes intended by the configuration.
How can I protect my applications against this flaw?
Protecting your systems requires an immediate package update, as no alternative workaround exists for this advisory. Similar to mitigating Barracuda Email Security Gateway bypass, administrators must apply patches promptly.
Follow these steps to upgrade your environment safely and remove the vulnerability from your dependency tree:
- Verify your project's lockfile to check if @fastify/http-proxy is used within versions 9.0.0 and 11.6.5.
- Run your package manager upgrade command to target version 11.6.6 or higher.
- Review the official details at and OpenJSF announcements.