Skip to main content
cve.nowby Sazabi
← npm
npmPackage

fastify

18 known vulnerabilities (8 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
18 · 8 high, 6 medium, 2 low
Weekly downloads
21.4M
Dependents
4,560
Registry
npm

Advisories 18

  • fastify vulnerable to header validation bypass via case-sensitive propertyNames

    Affected: from 5.12.2, fixed in 5.12.6.

  • CVE-2026-92081Medium 5.9

    fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

    Affected: fixed in 5.12.5.

  • fastify vulnerable to header validation bypass via incomplete schema case normalization

    Affected: fixed in 5.12.2.

  • fastify vulnerable to request validation bypass via skipped boolean false schemas

    Affected: fixed in 5.12.2.

  • fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

    Affected: from 4.0.0, fixed in 5.12.2.

  • fastify vulnerable to request body replacement via an async validation result collision

    Affected: fixed in 5.12.2.

  • CVE-2026-16732Medium 6.1

    fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count

    Affected: from 5.8.3, fixed in 5.12.1.

  • CVE-2026-18504Medium 5.4

    fastify vulnerable to schema validation bypass via root primitive coercion mismatch

    Affected: fixed in 5.12.1.

  • fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

    Affected: from 5.0.0, fixed in 5.3.2; from 4.29.0, fixed in 4.29.1; from 5.3.2, fixed in 5.8.5.

  • CVE-2026-3635Medium 6.1

    Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive…

    Affected: fixed in 5.8.3.

  • CVE-2026-3419Medium 5.3

    Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

    Affected: from 5.7.2, fixed in 5.8.1.

  • Fastify's Content-Type header tab character allows body validation bypass

    Affected: fixed in 5.7.2.

  • Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

    Affected: fixed in 5.7.3.

  • Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

    Affected: from 5.0.0, fixed in 5.3.2; from 4.29.0, fixed in 4.29.1; from 5.3.2, fixed in 5.8.5.

  • CVE-2022-41919Medium 4.2

    Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

    Affected: from 4.0.0, fixed in 4.10.2; from 3.0.0, fixed in 3.29.4.

Show all 18 advisoriesShow fewer advisories

  • Denial of service in Fastify via Content-Type header

    Affected: from 4.0.0, fixed in 4.8.1.

  • A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion…

    Affected: fixed in 2.15.1.

  • Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json"…

    Affected: fixed in 0.38.0.