What is CVE-2026-15631?

CVE-2026-15631 is a high-severity vulnerability in @Fastify/http-proxy, classified under Path Traversal. CVSS score: 8.7/10. Published 2026-07-18.

How severe is CVE-2026-15631?

High severity. CVSS v3 base score is 8.7 out of 10.

Path Traversal in @Fastify/http-proxy

CVE-2026-15631

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves t…

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.

Affected products

@Fastify/http-proxy — versions 9.4.0, 11.6.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

ce714d77-add3-4f53-aff5-83d477b104bb
ce714d77-add3-4f53-aff5-83d477b104bb

Frequently asked questions

What is CVE-2026-15631?: CVE-2026-15631 is a high-severity vulnerability in @Fastify/http-proxy, classified under Path Traversal. CVSS score: 8.7/10. Published 2026-07-18.
How severe is CVE-2026-15631?: High severity. CVSS v3 base score is 8.7 out of 10.