CVE-2026-16117: Fastify http-proxy Prefix Escape

Who Is Affected?

The confirmed affected product is @fastify/http-proxy. The NVD summary states that versions up to and including 11.5.0 are affected. The fixed version identified in the same source is 11.6.0. Based on the research note provided, this issue is associated with the Fastify ecosystem and the fastify/fastify-http-proxy package repository.

Organizations are affected if they run applications that depend on @fastify/http-proxy and use it in front of upstream services with a configured path prefix and rewritePrefix. The risk is highest where the proxy is internet-facing and where upstream path exposure is controlled primarily through proxy remapping rather than independent upstream authorization checks.

If you do not know whether your application uses the package directly, check lockfiles and dependency graphs. Node.js environments often include transitive dependencies, but exposure here is deployment-specific: the vulnerable package must be used in a live proxy configuration that relies on path rewriting. Even then, defenders should not assume limited impact. If the upstream trusts the proxy layer to constrain path visibility, the flaw can become immediately exploitable from the network.

Technical Notes

Check for the package and its installed version with standard Node package tooling:

npm ls @fastify/http-proxy

Or, if you use pnpm or yarn:

pnpm why @fastify/http-proxy
yarn why @fastify/http-proxy

Review package.json and lockfiles for versions <= 11.5.0 and treat any deployment using prefix plus rewritePrefix as potentially exposed until upgraded to 11.6.0.

CVSS Score Breakdown

The NVD data provided in the research note reports a CVSS base score of 10.0, which places this issue at the maximum severity level. However, the full vector string was not present in the source material provided here, so individual metric values cannot be quoted verbatim without inventing details. That matters because practitioners usually want to understand whether the score was driven by network exposure, low complexity, no privileges, or high impact on confidentiality, integrity, and availability.

Even without the exact vector string, the available description explains why the score is so high. The flaw is remotely reachable through HTTP requests, affects a common proxying function, and can bypass expected path restrictions to reach internal or administrative upstream endpoints. In environments where the proxy is the primary control separating public routes from sensitive upstream paths, the confidentiality and integrity implications can be severe. Availability impact depends on what the exposed upstream endpoints allow.

Because the exact vector is not available in the supplied record, defenders should use the 10.0 score as a signal of urgency rather than as a substitute for environment-specific analysis. If the vulnerable proxy sits in front of privileged upstream APIs, internal dashboards, or administrative handlers, prioritize it as an externally reachable critical issue.

Technical Notes

What we can state from the provided record:

CVSS Base Score: 10.0
CVSS Vector: Not present in the provided tool output

Operationally, assume worst-case exposure until you verify: 1. Whether the route is internet-accessible. 2. Whether rewritePrefix protects sensitive upstream paths. 3. Whether the upstream performs its own authentication and authorization.

Exploitation Status

Based on the research note, active exploitation in the wild is not confirmed. The issue is not listed in CISA KEV as of the cited check, which means there is no CISA-confirmed known exploitation entry to reference at this time. That is useful context, but it should not be treated as evidence of safety.

Also based on the provided sources, a public advisory exists, including the GitHub security advisory and the OpenJS Foundation CNA advisory index. However, the research note did not confirm a public proof-of-concept repository or exploit code during the source review. So the current defensible position is: advisory published, patch available, no confirmed public PoC identified in this pass, and no confirmed in-the-wild exploitation from the gathered sources.

For defenders, that still warrants fast action. URL parsing and path normalization bugs are relatively straightforward for researchers and attackers to test once an advisory explains the behavioral mismatch. When a flaw affects an internet-facing proxy and patch guidance is already available, exploit development often follows quickly even if no public PoC has been confirmed yet.

Technical Notes

Current status from the supplied research:

CISA KEV: No
In-the-wild exploitation: Not confirmed from gathered sources
Public PoC: Not confirmed from gathered sources
Public advisory: Yes

In absence of exploitation telemetry, assume opportunistic scanning may begin soon after disclosure, especially against Node.js services exposing Fastify routes over HTTP.