v11.6.7

What's Changed

• test: expect encoded backslashes to be rejected on the HTTP path by @mcollina in #496

Behavior change

@fastify/reply-from is now required at ^12.8.1, which includes the fix for GHSA-vp2r-3vgv-32g9. As a consequence, plain HTTP requests whose decoded path contains a backslash (e.g. /pub/foo%5Cbar) are now rejected with 400 Bad Request instead of being proxied.

WebSocket upgrades are not routed through @fastify/reply-from, so they still forward percent-encoded backslashes unchanged. Traversal attempts using backslashes are rejected on both paths, as before.

Full Changelog: v11.6.6...v11.6.7