Fastify vulnerabilities
37 CVEs and advisories name Fastify as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120216fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
- CVE-2026-107832fastify vulnerable to header validation bypass via case-sensitive propertyNames
- CVE-2026-92081fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- CVE-2026-84428fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-76169fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84504fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-16732fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- CVE-2026-18504fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- CVE-2026-33807@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
- CVE-2026-33808@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
- CVE-2026-33806fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
- CVE-2026-3635Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function
- CVE-2026-3419Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
- CVE-2026-25223Fastify's Content-Type header tab character allows body validation bypass
- CVE-2026-25224Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
- CVE-2026-22037@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
- CVE-2026-22031Fastify Middie Middleware Path Bypass
- CVE-2025-66415fastify-reply-from bypass of reply forwarding
- CVE-2025-32442Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
- CVE-2025-24033@fastify/multipart vulnerable to unlimited consumption of resources
- CVE-2024-35220@fastify/session reuses destroyed session cookie
- CVE-2024-31999@fastify/secure-session: Reuse of destroyed secure session cookie
- CVE-2024-22207Default swagger-ui configuration exposes all files in the module
- CVE-2023-51701@fastify-reply-from JSON Content-Type parsing confusion
- CVE-2023-29020Cross site request forgery token fixation in fastify-passport
- CVE-2023-29019Session fixation in fastify-passport
- CVE-2023-27495Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection
- CVE-2023-25576@fastify/multipart vulnerable to DoS due to unlimited number of parts
- CVE-2022-41919Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type