# cve.now: Fastify

The newest entries naming Fastify as an affected vendor (up to 200), of 37 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120216](https://cve.now/CVE-2026-120216.md): fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses (CVSS 5.9)
- [CVE-2026-107832](https://cve.now/CVE-2026-107832.md): fastify vulnerable to header validation bypass via case-sensitive propertyNames (CVSS 3.7)
- [CVE-2026-92081](https://cve.now/CVE-2026-92081.md): fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses (CVSS 5.9)
- [CVE-2026-84428](https://cve.now/CVE-2026-84428.md): fastify vulnerable to header validation bypass via incomplete schema case normalization (CVSS 7.5)
- [CVE-2026-84469](https://cve.now/CVE-2026-84469.md): fastify vulnerable to request validation bypass via skipped boolean false schemas (CVSS 7.5)
- [CVE-2026-76169](https://cve.now/CVE-2026-76169.md): fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (CVSS 7.5)
- [CVE-2026-84504](https://cve.now/CVE-2026-84504.md): fastify vulnerable to request body replacement via an async validation result collision (CVSS 8.1)
- [CVE-2026-16732](https://cve.now/CVE-2026-16732.md): fastify vulnerable to X-Forwarded-\* spoofing under trustProxy hop-count (CVSS 6.1)
- [CVE-2026-18504](https://cve.now/CVE-2026-18504.md): fastify vulnerable to schema validation bypass via root primitive coercion mismatch (CVSS 5.4)
- [CVE-2026-33807](https://cve.now/CVE-2026-33807.md): @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes (CVSS 9.1)
- [CVE-2026-33808](https://cve.now/CVE-2026-33808.md): @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) (CVSS 9.1)
- [CVE-2026-33806](https://cve.now/CVE-2026-33806.md): fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header (CVSS 7.5)
- [CVE-2026-3635](https://cve.now/CVE-2026-3635.md): Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function (CVSS 6.1)
- [CVE-2026-3419](https://cve.now/CVE-2026-3419.md): Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation (CVSS 5.3)
- [CVE-2026-25223](https://cve.now/CVE-2026-25223.md): Fastify's Content-Type header tab character allows body validation bypass (CVSS 7.5)
- [CVE-2026-25224](https://cve.now/CVE-2026-25224.md): Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream (CVSS 3.7)
- [CVE-2026-22037](https://cve.now/CVE-2026-22037.md): @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) (CVSS 8.4)
- [CVE-2026-22031](https://cve.now/CVE-2026-22031.md): Fastify Middie Middleware Path Bypass (CVSS 8.4)
- [CVE-2025-66415](https://cve.now/CVE-2025-66415.md): fastify-reply-from bypass of reply forwarding (CVSS 6.9)
- [CVE-2025-32442](https://cve.now/CVE-2025-32442.md): Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass (CVSS 7.5)
- [CVE-2025-24033](https://cve.now/CVE-2025-24033.md): @fastify/multipart vulnerable to unlimited consumption of resources (CVSS 7.5)
- [CVE-2024-35220](https://cve.now/CVE-2024-35220.md): @fastify/session reuses destroyed session cookie (CVSS 7.4)
- [CVE-2024-31999](https://cve.now/CVE-2024-31999.md): @fastify/secure-session: Reuse of destroyed secure session cookie (CVSS 7.4)
- [CVE-2024-22207](https://cve.now/CVE-2024-22207.md): Default swagger-ui configuration exposes all files in the module (CVSS 5.3)
- [CVE-2023-51701](https://cve.now/CVE-2023-51701.md): @fastify-reply-from JSON Content-Type parsing confusion (CVSS 5.3)
- [CVE-2023-29020](https://cve.now/CVE-2023-29020.md): Cross site request forgery token fixation in fastify-passport (CVSS 6.5)
- [CVE-2023-29019](https://cve.now/CVE-2023-29019.md): Session fixation in fastify-passport (CVSS 8.1)
- [CVE-2023-27495](https://cve.now/CVE-2023-27495.md): Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection (CVSS 5.3)
- [CVE-2023-25576](https://cve.now/CVE-2023-25576.md): @fastify/multipart vulnerable to DoS due to unlimited number of parts (CVSS 7.5)
- [CVE-2022-41919](https://cve.now/CVE-2022-41919.md): Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type (CVSS 4.2)
- [CVE-2022-39386](https://cve.now/CVE-2022-39386.md): fastify-websocket vulnerable to uncaught exception via crash on malformed packet (CVSS 7.5)
- [CVE-2022-39288](https://cve.now/CVE-2022-39288.md): Denial of service in Fastify via Content-Type header (CVSS 7.5)
- [CVE-2022-31142](https://cve.now/CVE-2022-31142.md): Potential Timing Attack Vector in @fastify/bearer-auth (CVSS 7.5)
- [CVE-2022-29220](https://cve.now/CVE-2022-29220.md): No verification of commits origin in github-action-merge-dependabot (CVSS 6.5)
- [CVE-2021-29624](https://cve.now/CVE-2021-29624.md): Lack of protection against cookie tossing attacks in fastify-csrf (CVSS 6.5)
- [CVE-2021-21321](https://cve.now/CVE-2021-21321.md): Prefix escape (CVSS 10.0)
- [CVE-2021-21322](https://cve.now/CVE-2021-21322.md): Prefix escape (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/fastify
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.