send

@fastify/send Send 是一个用于从文件系统流式传输文件作为 HTTP 响应的库，支持部分响应（Ranges）、条件 GET 协商（If-Match、If-Unmodified-Since、If-None-Match、If-Modified-Since）、高测试覆盖率，以及细粒度的事件，您可以在应用程序或框架中利用这些事件采取适当的操作。 安装 这是一个可通过 npm registry 获得的 Node.js 模块。使用 npm install 命令 进行安装： $ npm install @fastify/send TypeScript 如果要使用...

Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

CLSA-2026-1790870980 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.2...

CLSA-2026-1790857029 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.2...

CLSA-2026-1790854816 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.1...

EUVD-2026-80315

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses...

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

NPM: fastify vulnerable to request body replacement via an async validation result collision

NPM: fastify vulnerable to request body replacement via an async validation result collision vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

EUVD-2026-70984

fastify vulnerable to request body replacement via an async validation result collision...

EUVD-2026-70988

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers...

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...

EUVD-2026-70989

fastify vulnerable to request validation bypass via skipped boolean false schemas...

fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

EUVD-2026-70998

fastify vulnerable to header validation bypass via incomplete schema case normalization...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...