Skip to content
Fastify Fastify vulnerabilities
-
@clerk fastify
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
CVE-2026-120216
Fix available
5.9 Medium
-
@fastify/express
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
CVE-2026-112362
9.1 Critical
-
@clerk fastify
fastify vulnerable to header validation bypass via case-sensitive propertyNames
CVE-2026-107832
Fix available
3.7 Low
-
@clerk fastify
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
CVE-2026-92081
Fix available
5.9 Medium
-
@clerk fastify
fastify vulnerable to header validation bypass via incomplete schema case normalization
CVE-2026-84428
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to request validation bypass via skipped boolean false schemas
CVE-2026-84469
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
CVE-2026-76169
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to request body replacement via an async validation result collision
CVE-2026-84504
Fix available
8.1 High
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
CVE-2026-85184
9.1 Critical
-
@fastify/http-proxy, fastify fastify\/http-proxy +1 more
@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
CVE-2026-85124
7.5 High
-
@fastify/busboy, fastify fastify\/busyboy +1 more
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
CVE-2026-74866
Fix available
5.8 Medium
-
@clerk fastify
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CVE-2026-16732
Fix available
6.1 Medium
-
@clerk fastify
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
CVE-2026-18504
Public exploitFix available
5.4 Medium
-
@fastify/oauth2, fastify fastify\/oauth2 +1 more
@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies
CVE-2026-18165
4.2 Medium
-
@fastify/multipart, fastify fastify-multipart +1 more
@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
CVE-2026-19474
7.5 High
-
@fastify/multipart, fastify fastify-multipart +1 more
@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
CVE-2026-18549
7.5 High
-
@fastify/jwt, fastify fastify\/jwt +1 more
@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
CVE-2026-18500
8.1 High
-
@fastify/busboy, fastify fastify\/busyboy +1 more
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
CVE-2026-19484
Fix available
7.5 High
-
@fastify/busboy, fastify fastify\/busyboy +1 more
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
CVE-2026-19481
Fix available
7.5 High
-
@fastify/static, fastify fastify-static +1 more
@fastify/static vulnerable to route guard bypass via non-canonical path segments
CVE-2026-18427
7.5 High
-
@fastify/aws-lambda, fastify fastify\/aws-lambda +1 more
@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
CVE-2026-18248
9.1 Critical
-
@fastify/rate-limit, fastify fastify\/rate-limit +1 more
@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
CVE-2026-15144
7.3 High
-
@fastify/forwarded, fastify fastify\/forwarded +1 more
@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For
CVE-2026-18174
5.3 Medium
-
@fastify/static, fastify fastify-static +1 more
@fastify/static vulnerable to route guard bypass via path traversal
CVE-2026-15074
Fix available
7.5 High
-
@fastify/static, fastify fastify-static +1 more
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
CVE-2026-7120
Fix available
5.3 Medium
-
@fastify/http-proxy, fastify fastify\/http-proxy +1 more
@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
CVE-2026-16117
10.0 Critical
-
@fastify/http-proxy, fastify fastify\/http-proxy +1 more
@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
CVE-2026-15631
8.7 High
-
@fastify/reply-from, fastify fastify\/reply-from +1 more
@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
CVE-2026-16158
8.7 High
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
CVE-2026-14181
7.5 High
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
CVE-2026-14198
9.1 Critical
-
@fastify/express, fastify fastify\/express +1 more
@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
CVE-2026-6556
9.1 Critical
-
@fastify/accepts-serializer, fastify fastify\/accepts-serializer +1 more
@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
CVE-2026-7768
Fix available
7.5 High
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
CVE-2026-33804
Fix available
7.4 High
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
CVE-2026-6270
Fix available
9.1 Critical
-
@fastify/static, fastify fastify-static +1 more
@fastify/static vulnerable to path traversal in directory listing
CVE-2026-6410
Fix available
5.3 Medium
-
@fastify/static, fastify fastify-static +1 more
@fastify/static vulnerable to route guard bypass via encoded path separators
CVE-2026-6414
Fix available
5.9 Medium
-
@fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more
@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
CVE-2026-33805
Fix available
9.0 Critical
-
fastify @fastify/express, fastify\/express +1 more
@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
CVE-2026-33807
Fix available
9.1 Critical
-
fastify @fastify/express, fastify\/express +1 more
@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
CVE-2026-33808
Fix available
9.1 Critical
-
@clerk fastify
Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function
CVE-2026-3635
Fix available
6.1 Medium
-
@clerk fastify
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
CVE-2026-3419
Fix available
5.3 Medium
-
@fastify/middie, fastify fastify\/middie +1 more
@fastify/middie has an improper path normalization vulnerability
CVE-2026-2880
Fix available
8.2 High
-
@clerk fastify
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
CVE-2026-25224
Fix available
3.7 Low
-
@clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +3 more +5 more
Fastify's Content-Type header tab character allows body validation bypass
CVE-2026-25223
Fix available
7.5 High
-
fastify fastify-express
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
CVE-2026-22037
Fix available
8.4 High
-
fastify middie, fastify\/middie +1 more
Fastify Middie Middleware Path Bypass
CVE-2026-22031
Fix available
8.4 High
-
fastify fastify-reply-from, reply-from +1 more
fastify-reply-from bypass of reply forwarding
CVE-2025-66415
Fix available
6.9 Medium
-
@clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 more +3 more
fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
CVE-2026-33806
Fix available
7.5 High
-
@clerk fastify
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
CVE-2025-32442
Fix available
7.5 High
-
fastify fastify-multipart
@fastify/multipart vulnerable to unlimited consumption of resources
CVE-2025-24033
Fix available
7.5 High
- Show olderLoading…