fastify

@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/static vulnerable to route guard bypass via path traversal

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins