CVE-2026-85124
CVE-2026-85124: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-85124] @fastify/http-proxy: @fastify/http-proxy: Information disclosure via path traversal with backslash dot-segments
CVE-2026-85124Source published Source updated
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. Users should upgrade to @fastify/http-proxy 11.6.2 or later. This component, designed to proxy HTTP requests, does not correctly validate incoming request paths…
- Affected products in this advisory
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Source-reported affected versions
- < 11.6.2
- Source-reported fixed versions
- 11.6.2
- Mitigation guidance
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.