The vulnerability is a path restriction bypass caused by unsanitized decoded route parameters used in the rewritePrefix option of @fastify/http-proxy. An attacker can craft a URL that includes encoded path separators, query or fragment delimiters; when decoded, these characters become real separators and delimiters that alter the upstream path. The result is that the plugin injects additional upstream segments and removes the mandatory suffix that the prefix was intended to enforce, allowing access to resources outside the intended prefix. This flaw can lead to server‑side request forgery and possible authorization bypass in the proxied service. The weakness matches CWE‑22 (Path Traversal) and CWE‑436 (Inconsistent Validation).

Node.js applications that use @fastify/http-proxy version 9.0.0 through 11.6.5 with a parameterized prefix and rewritePrefix configuration are vulnerable. The affected product is the @fastify/http-proxy npm package, a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix.

The CVSS score of 9.1 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of mitigation does not reduce the risk. An unauthenticated remote attacker can simply send a crafted HTTP request to the proxy endpoint to trigger the path‑restriction bypass, leading to SSRF or privilege escalation in the proxied service. Because no authentication or privileged state is required to exploit the flaw, the risk is significant for any exposed proxy service.