1384 matches found
CVE-2026-92395
A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...
CVE-2026-107832
A flaw was found in fastify. The framework's route schema validation fails to properly normalize the casing of header names declared within nested property name schemas. A remote attacker can exploit this vulnerability by submitting requests with restricted headers, bypassing header allow-lists o...
Improper Handling of Case Sensitivity
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the lowerCaseHeadersSchema function in lib/validation.js, when a headers schema uses propertyNames with an enum or const constraint. Because...
CVE-2026-107832
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CVE-2026-107832
The fastify web framework for Node.js (versions 5.12.2 through 5.12.5 ) is vulnerable to a header validation bypass due to improper case sensitivity handling. Specifically, the routine that lowercases header names in a route schema fails to lowercase enum or const header names nested within a pro...
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CVE-2026-107832: Improper Handling of Case Sensitivity
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
PT-2026-111524
Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5 Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or...
CLSA-2026-1791839080 TuxCare security update for fastify (3 CVEs)
TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6...
CLSA-2026-1791806950 TuxCare security update for fastify (2 CVEs)
TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.2.1-tuxcare.5...
CLSA-2026-1791806519 TuxCare security update for fastify (3 CVEs)
TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5...
ROOT-APP-NPM-CVE-2026-19484 CVE-2026-19484 in @fastify/busboy - Patched by Root
Root has patched CVE-2026-19484 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-961622 AIKIDO-2026-961622 in @fastify/busboy - Patched by Root
Root has patched AIKIDO-2026-961622 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...
CLSA-2026-1791680737 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3...
CLSA-2026-1791667225 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.6...
CLSA-2026-1791667117 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.5...
CLSA-2026-1791634874 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.4...