What is CVE-2026-16117?

CVE-2026-16117 is a critical-severity vulnerability in @Fastify/http-proxy, classified under Improper Input Validation. CVSS score: 10.0/10. Published 2026-07-18.

How severe is CVE-2026-16117?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Improper input validation in @Fastify/http-proxy

CVE-2026-16117

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

Affected products

@Fastify/http-proxy — versions 0, 11.6.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

ce714d77-add3-4f53-aff5-83d477b104bb
ce714d77-add3-4f53-aff5-83d477b104bb

Frequently asked questions

What is CVE-2026-16117?: CVE-2026-16117 is a critical-severity vulnerability in @Fastify/http-proxy, classified under Improper Input Validation. CVSS score: 10.0/10. Published 2026-07-18.
How severe is CVE-2026-16117?: Critical severity. CVSS v3 base score is 10.0 out of 10.