CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

@leighton-digital/api-test-harness (>=1.1.2, <=1.1.3), @webiny/ai-powerups (>=0.0.0-unstable.9f53ea597d, <=6.5.0-beta.4) +67 more potentially affected by CVE-2026-18248 via @fastify/aws-lambda (6.4.0)

@fastify/aws-lambda NPM version 6.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/aws-lambda and may be impacted: - @leighton-digital/api-test-harness =1.1.2, =0.0.0-unstable.9f53ea597d, =0.0.0-unstable.6844005670,...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248

CVE-2026-18248 affects @fastify/aws-lambda 6.4.0, where request.awsLambda.event and request.awsLambda.context are decorated using client-controlled x-apigateway-event and x-apigateway-context headers. The getter may read untrusted headers before the internal per-invocation token, leaving reserved...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248: Insufficient Verification of Data Authenticity

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

PT-2026-67424

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

@a11ywatch/a11ywatch (>=0.1.66, <=0.3.82), @a11ywatch/core (>=0.5.0, <=0.8.17) +489 more potentially affected by CVE-2026-15144 via @fastify/rate-limit (>=6.0.1, <=11.1.0)

@fastify/rate-limit NPM version =6.0.1, =0.1.66, =0.5.0, =1.0.0, =0.1.1, =0.1.1, =1.0.0, =2.0.0, =3.0.0, =0.2.0, =0.1.1, =1.6.2, =1.0.3, =0.3.3, =0.2.0, =0.5.3 and more Source cves: CVE-2026-15144 Source advisory: MEND:CVE-2026-15144...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...

@alignable/bifrost-fastify (>=0.0.2, <=1.0.4), @anchan828/nest-redis-session-fastify (>=0.0.69, <=0.0.86) +61 more potentially affected by CVE-2026-18174 via @fastify/forwarded (>=1.0.0, <=2.2.0)

@fastify/forwarded NPM version =1.0.0, =0.0.2, =0.0.69, =2.7.0, =0.23.0, =0.37.0-dev.2883368c84, =0.23.0, =0.34.0-dev.154, =0.37.0-dev.2883368c84, =0.37.0-dev.2883368c84, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.38, =1.2.61 and more Source cves: CVE-2026-18174 Source advisory: MEND:CVE-2026-18174...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174: Improper Input Validation

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-15144: Improper Restriction of Excessive Authentication Attempts

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +16 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =0.7.1, =3.1.17, =1.3.8, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =5.1.0, =6.5.2, =4.6.0, =4.8.4 and more Source cves: CVE-2026-7120 Source advisory: OSV:GHSA-8PVW-JCV7-9CMJ...

GHSA-8PVW-JCV7-9CMJ @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Impact @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file o...

EUVD-2026-47870

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths...

@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +16 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =0.7.1, =3.1.17, =1.3.8, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =5.1.0, =6.5.2, =4.6.0, =4.8.4 and more Source cves: CVE-2026-7120 Source advisory: GHSA-8PVW-JCV7-9CMJ...