Latest vulnerabilities for vendor "fastify"

npm/@fastify/rate-limit@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

Risk 51

Severity

7.3

First published (updated )

CVE-2026-15144

npm/@fastify/forwarded@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

Risk 27

Severity

5.3

First published (updated )

CVE-2026-18174

npm/@fastify/static@fastify/static vulnerable to route guard bypass via path traversal

Risk 43

Severity

7.5

First published (updated )

CVE-2026-15074

npm/@fastify/static@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Risk 27

Severity

5.3

First published (updated )

CVE-2026-7120

npm/@fastify/http-proxy@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Risk 73

Severity

10

First published (updated )

CVE-2026-16117

npm/@fastify/http-proxy@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

Risk 73

Severity

10

First published (updated )

CVE-2026-15631

npm/@fastify/reply-from@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

Risk 73

Severity

10

First published (updated )

CVE-2026-16158

npm/@fastify/middie@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

Risk 43

Severity

7.5

First published (updated )

CVE-2026-14181

npm/@fastify/middie@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

Risk 66

Severity

9.1

First published (updated )

CVE-2026-14198

npm/@fastify/express@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

Risk 66

Severity

9.1

First published (updated )

CVE-2026-6556

npm/@fastify/accepts-serializer@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-7768

npm/@fastify/middie@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Risk 66

Severity

9.1

First published (updated )

CVE-2026-33804

npm/@fastify/middie@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Risk 47

Severity

9.1

EPSS

0.06%

First published (updated )

CVE-2026-6270

npm/@fastify/static@fastify/static vulnerable to path traversal in directory listing

Risk 19

Severity

5.3

EPSS

0.03%

First published (updated )

CVE-2026-6410

npm/@fastify/static@fastify/static vulnerable to route guard bypass via encoded path separators

Risk 26

Severity

5.9

EPSS

0.01%

First published (updated )

CVE-2026-6414

npm/@fastify/reply-from@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

Risk 57

Severity

9

First published (updated )

CVE-2026-33805

npm/@fastify/express@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

Risk 66

Severity

9.1

First published (updated )

CVE-2026-33807

npm/@fastify/express@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Risk 63

Severity

9.1

First published (updated )

CVE-2026-33808

fastify FastifyImpact: Fastify applications using schema.body.content for per-content-type body validation can hav…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2458596

npm/fastifyfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

Risk 43

Severity

7.5

First published (updated )

CVE-2026-33806

npm/fastifyFastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function

Risk 26

Severity

6.1

EPSS

0.01%

First published (updated )

CVE-2026-3635

npm/fastifyFastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Risk 19

Severity

5.3

EPSS

0.01%

First published (updated )

CVE-2026-3419

npm/@fastify/middie@fastify/middie has an improper path normalization vulnerability

Risk 47

Severity

8.2

EPSS

0.17%

First published (updated )

CVE-2026-2880

fastify FastifyFastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation …

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2436560

npm/fastifyFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Risk 15

Severity

3.7

EPSS

0.01%

First published (updated )

CVE-2026-25224

npm/fastifyFastify's Content-Type header tab character allows body validation bypass

Risk 31

Severity

7.5

EPSS

0.02%

First published (updated )

CVE-2026-25223

npm/@fastify/middieFastify Middie Middleware Path Bypass

Risk 56

Severity

8.8

EPSS

0.06%

First published (updated )

CVE-2026-22031

fastify reply-fromfastify-reply-from bypass of reply forwarding

Risk 41

Severity

6.9

First published (updated )

CVE-2025-66415

npm/fastifyFastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Risk 31

Severity

7.5

EPSS

0.06%

First published (updated )

CVE-2025-32442

npm/@fastify/multipart@fastify/multipart vulnerable to unlimited consumption of resources

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2025-24033

Trending

Vendor Risk Score

Software

npm/@fastify/rate-limit@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

npm/@fastify/forwarded@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

npm/@fastify/static@fastify/static vulnerable to route guard bypass via path traversal

npm/@fastify/static@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

npm/@fastify/http-proxy@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Don't miss critical vulnerabilities

npm/@fastify/http-proxy@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

npm/@fastify/reply-from@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

npm/@fastify/middie@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

npm/@fastify/middie@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

npm/@fastify/express@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

Don't miss critical vulnerabilities

npm/@fastify/accepts-serializer@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

npm/@fastify/middie@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

npm/@fastify/middie@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

npm/@fastify/static@fastify/static vulnerable to path traversal in directory listing

npm/@fastify/static@fastify/static vulnerable to route guard bypass via encoded path separators

Don't miss critical vulnerabilities

npm/@fastify/reply-from@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

npm/@fastify/express@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

npm/@fastify/express@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

fastify FastifyImpact: Fastify applications using schema.body.content for per-content-type body validation can hav…

npm/fastifyfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

Don't miss critical vulnerabilities

npm/fastifyFastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function

npm/fastifyFastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

npm/@fastify/middie@fastify/middie has an improper path normalization vulnerability

fastify FastifyFastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation …

npm/fastifyFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Don't miss critical vulnerabilities

npm/fastifyFastify's Content-Type header tab character allows body validation bypass

npm/@fastify/middieFastify Middie Middleware Path Bypass

fastify reply-fromfastify-reply-from bypass of reply forwarding

npm/fastifyFastify vulnerable to invalid content-type parsing, which could lead to validation bypass

npm/@fastify/multipart@fastify/multipart vulnerable to unlimited consumption of resources

Don't miss critical vulnerabilities

Company

Resources

Contact