A critical vulnerability (CVE-2026-16117) has been identified in @fastify/http-proxy versions up to 11.5.0 and the fastify platform. The issue arises when URL-encoded prefixes are not properly rewritten, allowing attackers to craft requests with encoded characters in the prefix segment. This causes the router to match the route but forward the original encoded path to upstream services. Upstream systems decoding the path may inadvertently expose restricted resources, enabling unauthorized access or data leakage. All users of affected versions are advised to upgrade immediately to patched releases, which include fixes for prefix rewriting logic. The CVSS score of 10.0 reflects the high severity due to remote code execution or data exposure risks. No workarounds are available. Developers should prioritize dependency updates to mitigate exploitation risks.