CVE-2026-15631 | fastify http-proxy up to 11.5.0 WebSocket Routing findUpstream path traversal

A vulnerability labeled as critical has been found in fastify http-proxy up to 11.5.0. This issue affects the function findUpstream of the component WebSocket Routing. Such manipulation leads to path traversal.

This vulnerability is traded as CVE-2026-15631. The attack may be launched remotely. There is no exploit available.