{"uuid": "a3d6d6c9-c86e-4f62-8788-065a3a45fe09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16117", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqwx274akf2i", "content": "\u26a0\ufe0f PATCH NOW\n\nA single URL-encoded character defeats @fastify/http-proxy's prefix rewrite (CVE-2026-16117, CVSS 10).\n\nThe internal and admin endpoints the proxy was hiding become reachable upstream. No workaround. Patch to 11.6.0.", "creation_timestamp": "2026-07-18T18:57:58.216671Z"}