⚠️ Security Release
This release fixes CVE-2026-85124, a high-severity path traversal vulnerability. In affected versions, backslash dot-segments could escape the configured rewritePrefix boundary for proxied HTTP requests and expose unintended upstream paths.
Upgrade to @fastify/http-proxy v11.6.2. There is no workaround.
What's Changed
- fix: validate HTTP rewrite destinations against
rewritePrefixin 2dd5125
Credits
- @EQSTLab for reporting the vulnerability
- @mcollina and @UlisesGascon for the remediation
Full Changelog: v11.6.1...v11.6.2
Contributors
mcollina, UlisesGascon, and EQSTLab