The vulnerability is present in the @fastify/http-proxy plugin, version 11.6.0 through 11.6.2. It allows an unauthenticated remote attacker to manipulate the request path by encoding backslashes and dot‑segments, thereby bypassing the proxy prefix validation. The attacker can access files or resources located outside the intended prefix on the upstream server. The impact identified is exclusively a confidentiality exposure, as the attacker gains read access to upstream resources that should be protected.

Affected products include the @fastify/http-proxy Fastify plugin, specifically versions 11.6.0, 11.6.1, and 11.6.2. The vulnerability has been rectified in version 11.6.3 and later, so any deployments using those releases are no longer impacted.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated HTTP request containing a crafted percent‑encoded path that resolves to a backslash followed by a double‑dot segment on systems that treat backslashes as path separators. The attack vector is remote and does not depend on privileged access, but success relies on the upstream server's path handling behavior. Monitoring for anomalous request patterns and applying the official patch reduces risk.