The vulnerability exists in @fastify/http‑proxy versions 9.4.0 through 11.5.0, where the WebSocket proxy does not validate the resolved destination path against the configured rewrite prefix. The path resolution uses the WHATWG URL constructor, which collapses dot segments, allowing a crafted WebSocket upgrade request containing traversal sequences to escape the intended prefix. This results in requests being forwarded to upstream endpoints that were not intended for exposure. The flaw is a variant of CVE‑2021‑21322 but operates in a code path that never applied the HTTP‑specific fix in fastify/reply‑from. As a result, an attacker can potentially direct the proxy to any reachable upstream service using a non‑normalizing WebSocket client, enabling unauthorized data access or malicious control of downstream services.

Any Node.js application that incorporates @fastify/http‑proxy in versions 9.4.0 to 11.5.0 is affected. The vulnerability applies to the entire @fastify/http‑proxy package used as a Fastify plugin or standalone HTTP WebSocket proxy.

The CVSS score is 8.7, indicating a high severity. The EPSS score is below 1 %, suggesting low probability of exploitation in the wild, although it is not zero. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires a WebSocket client or proxy that does not normalize the request path, so browsers and the standard ws package are not susceptible. However, raw HTTP clients or downstream proxies that forward the original path can enable the attack in production environments. Overall, the risk is significant for exposed WebSocket proxy deployments, but the attack window is limited by the need for a non‑normalizing client or an untrusted network path.