Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

send

@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...

npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox vulnerability discovered by ? in WordPress npm altair-fastify-plugin versions = 7.2.4, 8.5.8...

CVE-2026-117549

A flaw was found in @fastify/secure-session. When configured to use signed cookies, the component fails to reject cookies that fail signature validation, proceeding to decrypt and accept the session payload. A remote user holding an unexpired session cookie can exploit this issue to bypass sessio...

CVE-2026-92087

A flaw was found in @fastify/auth. When composing authentication strategies with the 'or' and 'all' options, and including a nested 'AND' group, the plugin evaluates these strategies in an order-dependent manner. This can cause an earlier failing authentication check to be ignored, resulting in t...

CVE-2026-117518

A flaw was found in @fastify/reply-from. The plugin only validates forward-slash dot-segments, allowing backslash sequences to bypass traversal checks when the upstream destination URL is constructed. An unauthenticated remote attacker can exploit this vulnerability by submitting requests with...

CVE-2026-120213

A flaw was found in @fastify/http-proxy. When applications configure path rewriting using route parameters, the plugin fails to re-encode decoded URL parameters before constructing upstream request paths. An unauthenticated remote attacker can exploit this flaw by sending requests containing...

CVE-2026-120215

A flaw was found in @fastify/cors. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a Cross-Origin Resource Sharing CORS preflight request to an application configured with a non-default hook. Under these conditions, the plugin improperly attempts to write response...

CVE-2026-110008

A flaw was found in @fastify/oauth2. Due to inconsistent cookie path handling during the authentication process, temporary verification cookies are not properly removed after the login flow completes. As a result, single-use authentication tokens persist throughout the user's browser session. A...

CVE-2026-120214

A flaw was found in @fastify/http-proxy. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by bypassing intended proxy routing restrictions. Due to improper path validation that processes backslashes before decoding request paths, encoded backslashes and...

Uncaught Exception

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Uncaught Exception via the handlerTimeout path in lib/route.js when a route returns a streaming response. When the server is configured with a nonzero handlerTimeout and a streaming...

@3sixty/api-server-fastify (>=0.20.0-next.0, <=0.20.0-next.10), @3sixty/engine-server (>=0.20.0-next.0, <=0.20.0-next.9) +484 more potentially affected by CVE-2026-120216 via fastify (>=5.8.1, <=5.12.7)

fastify NPM version =5.8.1, =0.20.0-next.0, =0.20.0-next.0, =0.20.0-next.0, =0.20.0-next.0, =0.20.0-next.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.1.0, =0.4.0, =0.0.0-vBETA-20260417080530, =0.0.1, =3.0.1 - @anrans001/pi-spark-control-plane 0.1.0 and more Source cves: CVE-2026-120216 Source...

CVE-2026-120216

A flaw was found in Fastify. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a request to a streaming endpoint when a custom handler timeout is configured. If a streaming response remains open past the configured timeout after response headers have already been sen...

CVE-2026-120214

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120215

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers,...

CVE-2026-120216

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-117531

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Lengt...

CVE-2026-117549

@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still...

CVE-2026-117518

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...