@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

CVE-2026-18165

A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery CSRF attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an...

CLSA-2026-1790110789 TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.2...

PT-2026-105368

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.2...

CLSA-2026-1789917910 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.6...

CLSA-2026-1789906142 TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.1...

CLSA-2026-1789896356 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.3...

CLSA-2026-1789896330 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.1...

PT-2026-103474

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.3...

PT-2026-103481

TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.6...

PT-2026-103473

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.1...

PT-2026-103480

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.1...

CLSA-2026-1789755224 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.7.4-tuxcare.2...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

PT-2026-102426

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.7.4-tuxcare.2...

CVE-2026-85124

A flaw was found in @fastify/http-proxy. This component, designed to proxy HTTP requests, does not correctly validate incoming request paths, specifically failing to account for backslash-based dot-segments. An unauthenticated network attacker can exploit this vulnerability to bypass the proxy's...

Improper Handling of Case Sensitivity

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the route matching process. An attacker can access protected files by altering the letter case of a path segment in a...

@appweaver/core (>=1.1.6, <=1.6.1), @buildplease/apikit (>=1.0.0, <=1.4.2) +61 more potentially affected by CVE-2026-90982 via @fastify/static (>=10.1.0, <=10.1.3)

@fastify/static NPM version =10.1.0, =1.1.6, =1.0.0, =0.11.1, =0.8.6, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =6.0.2-rc.52, =0.0.4, =0.0.6 - @cybozu/duck 0.36.1 and more Source cves: CVE-2026-90982 Source advisory:...

CVE-2026-90982

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...