EUVD-2026-70988

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers...

EUVD-2026-70989

fastify vulnerable to request validation bypass via skipped boolean false schemas...

fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

GHSA-HWR6-493R-VM6H fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84469 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84469 Source advisory: GHSA-HWR6-493R-VM6H...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84469 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84469 Source advisory: OSV:GHSA-HWR6-493R-VM6H...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

EUVD-2026-70998

fastify vulnerable to header validation bypass via incomplete schema case normalization...

fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84428 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84428 Source advisory: GHSA-9Q9J-Q6P8-XQ58...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84428 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84428 Source advisory: OSV:GHSA-9Q9J-Q6P8-XQ58...

GHSA-9Q9J-Q6P8-XQ58 fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-20510282...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: GHSA-9C5C-9QCX-Q35Q...

GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9C5C-9QCX-Q35Q...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...