Skip to content

@clerk Fastify vulnerabilities

@clerk fastify fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses CVE-2026-120216 5.9 MediumNovember 2, 2026
@clerk fastify fastify vulnerable to header validation bypass via case-sensitive propertyNames CVE-2026-107832 Fix available 3.7 LowOctober 13, 2026
@clerk fastify fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses CVE-2026-92081 Fix available 5.9 MediumSeptember 16, 2026
@clerk fastify fastify vulnerable to header validation bypass via incomplete schema case normalization CVE-2026-84428 Fix available 7.5 HighSeptember 4, 2026
@clerk fastify fastify vulnerable to request validation bypass via skipped boolean false schemas CVE-2026-84469 Fix available 7.5 HighSeptember 4, 2026
@clerk fastify fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVE-2026-76169 Fix available 7.5 HighSeptember 4, 2026
@clerk fastify fastify vulnerable to request body replacement via an async validation result collision CVE-2026-84504 Fix available 8.1 HighSeptember 4, 2026
@clerk fastify fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count CVE-2026-16732 Fix available 6.1 MediumAugust 18, 2026
@clerk fastify fastify vulnerable to schema validation bypass via root primitive coercion mismatch CVE-2026-18504 Public exploitFix available 5.4 MediumAugust 18, 2026
@clerk backend, nextjs, shared +31 more +33 more Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
@clerk fastify Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function CVE-2026-3635 Fix available 6.1 MediumMarch 23, 2026
@clerk fastify Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation CVE-2026-3419 Fix available 5.3 MediumMarch 5, 2026
@clerk fastify Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream CVE-2026-25224 Fix available 3.7 LowFebruary 2, 2026
@clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +3 more +5 more Fastify's Content-Type header tab character allows body validation bypass CVE-2026-25223 Fix available 7.5 HighFebruary 2, 2026
@clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 more +3 more fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVE-2026-33806 Fix available 7.5 HighApril 18, 2025
@clerk fastify Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVE-2025-32442 Fix available 7.5 HighApril 18, 2025
@clerk fastify Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type CVE-2022-41919 Fix available 4.2 MediumNovember 21, 2022
@clerk fastify Denial of service in Fastify via Content-Type header CVE-2022-39288 Fix available EPSS 59.2% 7.5 HighOctober 10, 2022
@clerk fastify Denial of service in fastify CVE-2020-8192 Fix available 6.5 MediumJuly 30, 2020