1392 matches found
send
@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...
Fastify Swagger-UI - Information Disclosure
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...
EUVD-2026-98697
fastify is vulnerable to header validation bypass via case-sensitive propertyNames...
npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames
npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames vulnerability discovered by ? in WordPress npm fastify versions = 5.12.2, 5.12.6...
CVE-2026-112712
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
CVE-2026-112712
The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...
CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
EUVD-2026-105361
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
Fastify fast-uri input validation vulnerability
The Fastify fast-uri versions from 2.4.2 to 2.4.7, 3.1.3 to 3.1.8, and 4.0.1 to 4.2.2 have security vulnerabilities. These vulnerabilities stem from the canonicalizeHost function, which does not check whether the WHATWG URL parser treats the entire input as a host for host name consumption. As a...
Fastify fast-uri: Vulnerability due to improper output processing
Versions of Fastify prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 contain security vulnerabilities. These vulnerabilities arise when the serialize, normalize, or resolve methods are used with a reference option set to a value other than the default suffix, and when the referenced...
Fastify fast-uri path traversal vulnerability
Versions of Fastify prior to 2.4.8, as well as versions 3.0.0 through 3.1.8 and 4.0.0 through 4.2.2, have a path traversal vulnerability. This vulnerability stems from incorrect execution of the RFC 3986 segment deletion operations by the normalize and serialize functions when dealing with relati...
Fastify fast-uri input validation vulnerability
Versions of Fastify prior to 2.4.8, as well as versions 3.0.0 to 3.1.8 and 4.0.0 to 4.2.2, contain security vulnerabilities. These vulnerabilities stem from the use of the outdated global unescape function for percent decoding before verifying scheme components. This may result in dangerous schem...
CVE-2026-110008
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008
The @fastify/oauth2 library (versions 7.2.0 through 8.3.1 ) is vulnerable to Login CSRF because state and code-verifier cookies are set without a Path attribute on routes with multiple segments. During the OAuth callback, the clearing step uses a root path, causing the original cookies to persist...
CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
EUVD-2026-104327
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...