The vulnerability in @fastify/http-proxy prior to version 11.6.2 allows an attacker to craft HTTP requests containing backslash-based dot segments. Because the plain HTTP request handler does not validate these segments against the configured prefix or rewritePrefix boundaries, and the underlying reply-from library only rejects forward slash traversal, the proxy can forward requests that escape the intended path limiting. This results in an attacker being able to access upstream endpoints that should remain hidden behind the proxy, leading to disclosure of internal resources. This is a classic path traversal flaw (CWE-22).

The affected product is the @fastify/http-proxy middleware library, specifically all releases before 11.6.2. Users of any unsupported version including 11.5, 11.6.1, and earlier are vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. While the EPSS score is not available, the ability to perform the attack through simple, unauthenticated network requests increases the potential for real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog, but its ability to expose internal endpoints without authentication provides a substantial risk to any service relying on the proxy to conceal internal APIs.