@fastify/reply-from @fastify/http-proxy vulnerabilities

• @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via decoded route parameters CVE-2026-120213 9.1 CriticalNovember 2, 2026
• @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments CVE-2026-120214 5.9 MediumNovember 2, 2026
• @fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments CVE-2026-85124 7.5 HighSeptember 3, 2026
• @fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters CVE-2026-16117 10.0 CriticalJuly 18, 2026
• @fastify/http-proxy, fastify fastify\/http-proxy +1 more @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal CVE-2026-15631 8.7 HighJuly 18, 2026
• @fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVE-2026-33805 Fix available 9.0 CriticalApril 15, 2026