# fastify (npm) vulnerabilities

18 known vulnerabilities (8 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 21.4M
- Dependents: 4,560
- Registry: https://www.npmjs.com/package/fastify

## Advisories (18)

### [CVE-2026-107832](https://cve.now/CVE-2026-107832): fastify vulnerable to header validation bypass via case-sensitive propertyNames

- Severity: Low 3.7
- Published: Oct 13, 2026
- Affected: from 5.12.2, fixed in 5.12.6.

### [CVE-2026-92081](https://cve.now/CVE-2026-92081): fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

- Severity: Medium 5.9
- Published: Sep 16, 2026
- Affected: fixed in 5.12.5.

### [CVE-2026-84428](https://cve.now/CVE-2026-84428): fastify vulnerable to header validation bypass via incomplete schema case normalization

- Severity: High 7.5
- Published: Sep 4, 2026
- Affected: fixed in 5.12.2.

### [CVE-2026-84469](https://cve.now/CVE-2026-84469): fastify vulnerable to request validation bypass via skipped boolean false schemas

- Severity: High 7.5
- Published: Sep 4, 2026
- Affected: fixed in 5.12.2.

### [CVE-2026-76169](https://cve.now/CVE-2026-76169): fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

- Severity: High 7.5
- Published: Sep 4, 2026
- Affected: from 4.0.0, fixed in 5.12.2.

### [CVE-2026-84504](https://cve.now/CVE-2026-84504): fastify vulnerable to request body replacement via an async validation result collision

- Severity: High 8.1
- Published: Sep 4, 2026
- Affected: fixed in 5.12.2.

### [CVE-2026-16732](https://cve.now/CVE-2026-16732): fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count

- Severity: Medium 6.1
- Published: Aug 18, 2026
- Affected: from 5.8.3, fixed in 5.12.1.

### [CVE-2026-18504](https://cve.now/CVE-2026-18504): fastify vulnerable to schema validation bypass via root primitive coercion mismatch

- Severity: Medium 5.4
- Published: Aug 18, 2026
- Affected: fixed in 5.12.1.

### [CVE-2026-33806](https://cve.now/CVE-2026-33806): fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

- Severity: High 7.5
- Published: Apr 15, 2026
- Affected: from 5.0.0, fixed in 5.3.2; from 4.29.0, fixed in 4.29.1; from 5.3.2, fixed in 5.8.5.

### [CVE-2026-3635](https://cve.now/CVE-2026-3635): Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive…

- Severity: Medium 6.1
- Published: Mar 23, 2026
- Affected: fixed in 5.8.3.

### [CVE-2026-3419](https://cve.now/CVE-2026-3419): Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

- Severity: Medium 5.3
- Published: Mar 6, 2026
- Affected: from 5.7.2, fixed in 5.8.1.

### [CVE-2026-25223](https://cve.now/CVE-2026-25223): Fastify's Content-Type header tab character allows body validation bypass

- Severity: High 7.5
- Published: Feb 3, 2026
- Affected: fixed in 5.7.2.

### [CVE-2026-25224](https://cve.now/CVE-2026-25224): Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

- Severity: Low 3.7
- Published: Feb 3, 2026
- Affected: fixed in 5.7.3.

### [CVE-2025-32442](https://cve.now/CVE-2025-32442): Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

- Severity: High 7.5
- Published: Apr 18, 2025
- Affected: from 5.0.0, fixed in 5.3.2; from 4.29.0, fixed in 4.29.1; from 5.3.2, fixed in 5.8.5.

### [CVE-2022-41919](https://cve.now/CVE-2022-41919): Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

- Severity: Medium 4.2
- Published: Nov 22, 2022
- Affected: from 4.0.0, fixed in 4.10.2; from 3.0.0, fixed in 3.29.4.

### [CVE-2022-39288](https://cve.now/CVE-2022-39288): Denial of service in Fastify via Content-Type header

- Severity: High 7.5
- Published: Oct 10, 2022
- Affected: from 4.0.0, fixed in 4.8.1.

### [CVE-2020-8192](https://cve.now/CVE-2020-8192): A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion…

- Severity: Unrated
- Published: Jul 30, 2020
- Affected: fixed in 2.15.1.

### [CVE-2018-3711](https://cve.now/CVE-2018-3711): Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json"…

- Severity: Unrated
- Published: Jun 7, 2018
- Affected: fixed in 0.38.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/fastify
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.