1225 matches found
send
@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...
Fastify Swagger-UI - Information Disclosure
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...
CVE-2026-92395
A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...
CVE-2026-107832
A flaw was found in fastify. The framework's route schema validation fails to properly normalize the casing of header names declared within nested property name schemas. A remote attacker can exploit this vulnerability by submitting requests with restricted headers, bypassing header allow-lists o...
Improper Handling of Case Sensitivity
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the lowerCaseHeadersSchema function in lib/validation.js, when a headers schema uses propertyNames with an enum or const constraint. Because...
CVE-2026-107832
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CVE-2026-107832
The fastify web framework for Node.js (versions 5.12.2 through 5.12.5 ) is vulnerable to a header validation bypass due to improper case sensitivity handling. Specifically, the routine that lowercases header names in a route schema fails to lowercase enum or const header names nested within a pro...
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...
CLSA-2026-1791839080 TuxCare security update for fastify (3 CVEs)
TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6...
CLSA-2026-1791806950 TuxCare security update for fastify (2 CVEs)
TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.2.1-tuxcare.5...
CLSA-2026-1791806519 TuxCare security update for fastify (3 CVEs)
TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5...
ROOT-APP-NPM-CVE-2026-19481 CVE-2026-19481 in @fastify/busboy - Patched by Root
Root has patched CVE-2026-19481 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-961622 AIKIDO-2026-961622 in @fastify/busboy - Patched by Root
Root has patched AIKIDO-2026-961622 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-19484 CVE-2026-19484 in @fastify/busboy - Patched by Root
Root has patched CVE-2026-19484 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...
CLSA-2026-1791680737 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3...
CLSA-2026-1791667225 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.6...
CLSA-2026-1791667117 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.5...