Threats affecting pkg:npm/@fastify/http-proxy

@fastify/http-proxy versions 9.0.0 through 11.6.5 contain a path traversal vulnerability due to improper handling of URL-decoded route parameters in the rewritePrefix option. This allows an unauthenticated attacker to bypass path restrictions and potentially perform server-side request forgery or authorization bypass on the upstream service. The issue is fixed in version 11.6.6, and upgrading is required as no other workaround exists.

@fastify/http-proxy versions 11.6.0 through 11.6.2 contain a path traversal vulnerability due to improper normalization of backslashes before percent-decoding the request path. This allows an unauthenticated remote attacker to access resources outside the intended proxy prefix on upstream servers that treat backslashes as path separators. The vulnerability impacts confidentiality but not integrity or availability. The issue is fixed in version 11.6.3.