CLSA-2026-1790870980 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.2...

CLSA-2026-1790863084 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.4...

CLSA-2026-1790857029 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.2...

CLSA-2026-1790854816 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.1...

GHSA-4MH8-R7RC-XPVC fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +555 more potentially affected by CVE-2026-92081 via fastify (>=5.0.0-alpha.2, <=5.12.4)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.4.0, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =2.0.5 and more Source cves: CVE-2026-92081 Source advisory: GHSA-4MH8-R7RC-XPVC...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +555 more potentially affected by CVE-2026-92081 via fastify (>=5.0.0-alpha.2, <=5.12.4)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.4.0, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =2.0.5 and more Source cves: CVE-2026-92081 Source advisory: OSV:GHSA-4MH8-R7RC-XPVC...

EUVD-2026-80315

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

GHSA-667R-XXJV-C9MM fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84504 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84504 Source advisory: GHSA-667R-XXJV-C9MM...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84504 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84504 Source advisory: OSV:GHSA-667R-XXJV-C9MM...

NPM: fastify vulnerable to request body replacement via an async validation result collision

NPM: fastify vulnerable to request body replacement via an async validation result collision vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

EUVD-2026-70984

fastify vulnerable to request body replacement via an async validation result collision...

fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers vulnerability discovered by ? in WordPress Npm fastify versions = 4.0.0, 5.12.2...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +3000 more potentially affected by CVE-2026-76169 via fastify (>=4.0.2, <=5.12.1)

fastify NPM version =4.0.2, =1.0.0, =1.0.5, =1.0.3, =0.0.3, =0.1.0, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =3.0.0, =0.1.0, =2.0.0, =3.0.0, =0.0.1, =0.2.0 and more Source cves: CVE-2026-76169 Source advisory: OSV:GHSA-P68Q-WCHP-6FH7...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +3000 more potentially affected by CVE-2026-76169 via fastify (>=4.0.2, <=5.12.1)

fastify NPM version =4.0.2, =1.0.0, =1.0.5, =1.0.3, =0.0.3, =0.1.0, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =3.0.0, =0.1.0, =2.0.0, =3.0.0, =0.0.1, =0.2.0 and more Source cves: CVE-2026-76169 Source advisory: GHSA-P68Q-WCHP-6FH7...

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...