@fastify/http-proxy's handling of the rewritePrefix option contains a flaw. When the prefix includes URL‑encoded characters, the proxy does not rewrite the request path as intended, forwarding the raw encoded segment to the upstream server. This flaw allows an attacker to craft requests that reach internal or administrative endpoints that the proxy was meant to hide. The flaw can lead to unauthorized disclosure of sensitive data or further exploitation of the upstream service. Based on the description, it is inferred that an attacker could potentially use the exposed endpoints to compromise the upstream service if it contains additional vulnerabilities.

This affects Node.js applications that use the @fastify/http-proxy package versions up to and including 11.5.0. The vulnerability is present whenever rewritePrefix is configured to remove path segments that could be URL‑encoded. Applications employing older versions of this package and exposing the proxy should be investigated. No specific operating system or platform is required beyond a Node.js runtime using Fastify.

The CVSS score is 10, indicating critical severity. The EPSS score is below 1%, meaning the probability of exploitation in the wild is low, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the flaw can be triggered with a crafted HTTP request to the proxy, so all deployments using affected versions should address it immediately. The attack merely requires network access to the proxy endpoint; no privileged credentials are necessary.