[ Vendor · 6 CVEs ]
fastify
CVEs affecting fastify published in the last 30 days, plus any fastify CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107832 | 13 Oct 2026 | CVSS 3.7 | fastify is vulnerable to header validation bypass via case-sensitive propertyNamesfastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in… | Fix |
| CVE-2026-92081 | 16 Sep 2026 | CVSS 5.9 | fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responsesfastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via… | Fix |
| CVE-2026-84428 | 4 Sep 2026 | CVSS 7.5 | fastify vulnerable to header validation bypass via incomplete schema case normalizationfastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before… | Fix |
| CVE-2026-84469 | 4 Sep 2026 | CVSS 7.5 | fastify vulnerable to request validation bypass via skipped boolean false schemasfastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean… | Fix |
| CVE-2026-76169 | 4 Sep 2026 | CVSS 7.5 | fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersfastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different… | Fix |
| CVE-2026-84504 | 4 Sep 2026 | CVSS 8.1 | fastify vulnerable to request body replacement via an async validation result collisionfastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator… | Fix |