send

@fastify/send Send는 파일 시스템에서 파일을 HTTP 응답으로 스트리밍하기 위한 라이브러리로, 부분 응답Ranges, 조건부 GET 협상If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, 높은 테스트 커버리지, 그리고 애플리케이션이나 프레임워크에서 적절한 조치를 취하는 데 활용할 수 있는 세분화된 이벤트를 지원합니다. Installation 이 모듈은 npm 레지스트리를 통해 제공되는 Node.js 모듈입니다. 설치 방법은 npm install 명령...

Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

CVE-2026-75021

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-75021

fastify-cli (versions 1.5.0 through 8.0.1) starts the Node.js Inspector when a debug flag is used, but ignores the explicit bind address the user supplies, binding the Inspector to a broadly reachable address instead of the intended loopback. Because the Inspector protocol permits arbitrary code ...

CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

EUVD-2026-72734

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-18174

A flaw was found in @fastify/forwarded. This component, responsible for resolving client addresses from the X-Forwarded-For header, fails to strip horizontal tab characters when processing multiple comma-separated entries. A remote attacker could exploit this by injecting tab characters into the...

Authentication Bypass Using an Alternate Path or Channel

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and...

CVE-2026-84428

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428

A flaw was found in fastify. Due to incomplete case normalization of HTTP header names within a route's header schema, specifically within the JSON Schema Draft 7 dependencies keyword, an unauthenticated remote attacker can bypass intended conditional checks. This allows the attacker to send...

CVE-2026-84469

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...

Improper Validation of Unsafe Equivalence in Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced...

EUVD-2026-70998

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428

fastify versions before 5.12.2 are vulnerable to a header validation bypass caused by incomplete case normalization in the JSON Schema Draft 7 dependencies keyword. While the library lowercases property keys and the root-level required array to accommodate HTTP's case-insensitive headers, it fail...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-76169

A flaw was found in fastify. Malformed URLs can be routed to a custom not-found handler of a different plugin, bypassing the intended security checks. This allows an unauthenticated attacker to access and read the full response of an authentication-protected private fallback, leading to informati...

CVE-2026-84469

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...