Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

CVE-2026-92087

A flaw was found in @fastify/auth. When composing authentication strategies with the 'or' and 'all' options, and including a nested 'AND' group, the plugin evaluates these strategies in an order-dependent manner. This can cause an earlier failing authentication check to be ignored, resulting in t...

CVE-2026-117518

A flaw was found in @fastify/reply-from. The plugin only validates forward-slash dot-segments, allowing backslash sequences to bypass traversal checks when the upstream destination URL is constructed. An unauthenticated remote attacker can exploit this vulnerability by submitting requests with...

CVE-2026-120213

A flaw was found in @fastify/http-proxy. When applications configure path rewriting using route parameters, the plugin fails to re-encode decoded URL parameters before constructing upstream request paths. An unauthenticated remote attacker can exploit this flaw by sending requests containing...

CVE-2026-120215

A flaw was found in @fastify/cors. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a Cross-Origin Resource Sharing CORS preflight request to an application configured with a non-default hook. Under these conditions, the plugin improperly attempts to write response...

CVE-2026-110008

A flaw was found in @fastify/oauth2. Due to inconsistent cookie path handling during the authentication process, temporary verification cookies are not properly removed after the login flow completes. As a result, single-use authentication tokens persist throughout the user's browser session. A...

CVE-2026-120214

A flaw was found in @fastify/http-proxy. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by bypassing intended proxy routing restrictions. Due to improper path validation that processes backslashes before decoding request paths, encoded backslashes and...

CVE-2026-120216

A flaw was found in Fastify. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a request to a streaming endpoint when a custom handler timeout is configured. If a streaming response remains open past the configured timeout after response headers have already been sen...

CVE-2026-120214

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120215

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers,...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120216

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-117531

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Lengt...

CVE-2026-117549

@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still...

CVE-2026-117518

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

EUVD-2026-115128

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-120216

The fastify web framework for Node.js (versions 5.8.0 through 5.12.7 ) is vulnerable to a Denial of Service (DoS) condition. When the server is configured with a non-zero handlerTimeout and a route returns a streaming response , a request that remains open past the timeout—but has already sent it...