fastify

Products

Exploited and recent CVEs

• CVE-2026-120216 Medium 5.9 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses 0.3%
• CVE-2026-107832 Low 3.7 fastify vulnerable to header validation bypass via case-sensitive propertyNames 0.3%
• CVE-2026-92081 Medium 5.9 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses 0.4%
• CVE-2026-84428 High 7.5 fastify vulnerable to header validation bypass via incomplete schema case normalization 0.5%
• CVE-2026-84469 High 7.5 fastify vulnerable to request validation bypass via skipped boolean false schemas 0.5%
• CVE-2026-76169 High 7.5 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers 0.5%
• CVE-2026-84504 High 8.1 fastify vulnerable to request body replacement via an async validation result collision 0.4%
• CVE-2026-16732 Medium 6.1 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count 0.2%
• CVE-2026-18504 Medium 5.4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch 0.3%
• CVE-2026-33807 Critical 9.1 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes 0.4%
• CVE-2026-33808 Critical 9.1 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) 0.5%
• CVE-2026-33806 High 7.5 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header 0.4%
• CVE-2026-3635 Medium 6.1 Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function 0.2%
• CVE-2026-3419 Medium 5.3 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation 0.4%
• CVE-2026-25223 High 7.5 Fastify's Content-Type header tab character allows body validation bypass 0.9%
• CVE-2026-25224 Low 3.7 Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream 0.5%
• CVE-2026-22037 High 8.4 @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) 0.3%
• CVE-2026-22031 High 8.4 Fastify Middie Middleware Path Bypass 0.5%
• CVE-2025-66415 Medium 6.9 fastify-reply-from bypass of reply forwarding 0.2%
• CVE-2025-32442 High 7.5 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass 0.7%
• CVE-2025-24033 High 7.5 @fastify/multipart vulnerable to unlimited consumption of resources 0.6%
• CVE-2024-35220 High 7.4 @fastify/session reuses destroyed session cookie 0.4%
• CVE-2024-31999 High 7.4 @fastify/secure-session: Reuse of destroyed secure session cookie 0.6%
• CVE-2024-22207 Medium 5.3 Default swagger-ui configuration exposes all files in the module 2.3%
• CVE-2023-51701 Medium 5.3 @fastify-reply-from JSON Content-Type parsing confusion 0.5%
• CVE-2023-29020 Medium 6.5 Cross site request forgery token fixation in fastify-passport 0.4%
• CVE-2023-29019 High 8.1 Session fixation in fastify-passport 0.8%
• CVE-2023-27495 Medium 5.3 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection 0.3%
• CVE-2023-25576 High 7.5 @fastify/multipart vulnerable to DoS due to unlimited number of parts 1.5%
• CVE-2022-41919 Medium 4.2 Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type 0.4%