High [CVE-2026-85124] @fastify/http-proxy: @fastify/http-proxy: Information disclosure via path traversal with backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream.

The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options.

An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. Users should upgrade to @fastify/http-proxy 11.6.2 or later.

This component, designed to proxy HTTP requests, does not correctly validate incoming request paths, specifically failing to account for backslash-based dot-segments. This allows them to access internal network endpoints that should be protected, leading to the disclosure of sensitive information.

This Important flaw in `@fastify/http-proxy` allows an unauthenticated network attacker to bypass proxy path validation using backslash dot-segments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces.

Red Hat does not currently list a fixing RHSA for this CVE.