1385 matches found
CVE-2026-92087 @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as ...
CVE-2026-92087
@fastify/auth (a Fastify plugin for composing authentication and authorization strategies) is vulnerable to authorization bypass in versions 5.0.0 through 5.1.0 . When strategies are composed using the or relation with the run: "all" option and a nested array acting as an AND group, the group is ...
@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +555 more potentially affected by CVE-2026-92081 via fastify (>=5.0.0-alpha.2, <=5.12.4)
fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.4.0, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =2.0.5 and more Source cves: CVE-2026-92081 Source advisory: SNYK:JS-FASTIFY-19883909...
Uncaught Exception
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Uncaught Exception via the reply.trailer function when handling HTTP/2 trailer responses. An attacker can cause the server process to crash and terminate all active requests by sending ...
CVE-2026-92081
A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...
CVE-2026-92081
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
CVE-2026-92081
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +4045 more potentially affected by CVE-2026-92081 via fastify (>=0.5.0, <=5.12.4)
fastify NPM version =0.5.0, =1.0.0, =1.0.5, =1.0.0, =1.0.0, =0.0.0, =0.0.1, =1.0.3, =0.0.1, =0.1.66, =0.5.0, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2-canary.2 and more Source cves: CVE-2026-92081 Source advisory: MEND:CVE-2026-92081...
CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
CVE-2026-92081
fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...
CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
CVE-2026-92395: Authentication Bypass by Spoofing
@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...
PT-2026-93404
Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.5 Description When a route registers a response trailer using the reply.trailer function and is served over HTTP/2, the framework unconditionally sets the Transfer-Encoding: chunked header. Because this header is...
CVE-2026-92087: Improper Authorization
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as ...
PT-2026-93764
Name of the Vulnerable Software and Affected Versions @fastify/auth versions 5.0.0 through 5.1.0 Description This plugin composes multiple authentication and authorization strategies into a single route guard. An issue exists when strategies are composed using the relation "or" option combined wi...
PT-2026-93809
Name of the Vulnerable Software and Affected Versions @fastify/proxy-addr versions 3.0.0 through 5.1.0 Description This plugin, used to determine a request's client address behind trusted reverse proxies, incorrectly handles trust subnets written in IPv4-mapped IPv6 notation when an IPv4-sized...
CVE-2026-92081: Uncaught Exception
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...
Linux Distros Unpatched Vulnerability : CVE-2026-86818
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an...