SUSE CVE-2026-19484

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

PT-2026-77312

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.1 Description A schema validation bypass occurs when a request body schema targets a root primitive value. When validating a top-level primitive, such as an integer, Ajv a JSON schema validator may coerce a JSON...

CVE-2026-18504: Improper Input Validation

fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...

PT-2026-77311

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.3 through 5.12.0 Description An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the trustProxy setting is configured with a numeric hop-count...

CVE-2026-16732: Use of Less Trusted Source

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

Cross-site Request Forgery (CSRF)

Overview @fastify/oauth2 is a Perform login using oauth2 protocol Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the OAuth state-check cookies in the index.js authorization flow. An attacker can log a victim into the attacker’s account by planting...

@appweaver/core (>=1.0.8, <=1.4.1), @buildplease/apikit (>=1.0.0, <=1.0.1) +15 more potentially affected by CVE-2026-19474 via @fastify/multipart (>=10.0.0, <=10.1.0)

@fastify/multipart NPM version =10.0.0, =1.0.8, =1.0.0, =4.0.1, =5.3.0, =0.0.17, =2.5.0, =2.2.1, =20260128.2248.28, =20260411.1248.30, =20260828.1636.54, =1.0.1, =0.11.0, =0.0.0-unstable.9f53ea597d, =5.21.1-beta.15, =6.0.1-alpha.2 and more Source cves: CVE-2026-19474 Source advisory:...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete temporary-file handling in saveRequestFiles in index.js. An attacker can exhaust disk space by sending a multipart request that completes one file...

@appweaver/core (>=1.0.0, <=1.4.1), @bryopsida/object-store (>=0.1.0, <=0.1.7) +11 more potentially affected by CVE-2026-18165 via @fastify/oauth2 (>=7.9.0, <=8.2.0)

@fastify/oauth2 NPM version =7.9.0, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.13.0, =1.4.30, =1.2.0, =0.0.14, =0.0.19 Source cves: CVE-2026-18165 Source advisory: SNYK:JS-FASTIFYOAUTH2-18902506...

@appweaver/core (>=1.0.8, <=1.4.1), @buildplease/apikit (>=1.0.0, <=1.0.1) +15 more potentially affected by CVE-2026-18549 via @fastify/multipart (>=10.0.0, <=10.1.0)

@fastify/multipart NPM version =10.0.0, =1.0.8, =1.0.0, =4.0.1, =5.3.0, =0.0.17, =2.5.0, =2.2.1, =20260128.2248.28, =20260411.1248.30, =20260828.1636.54, =1.0.1, =0.11.0, =0.0.0-unstable.9f53ea597d, =5.21.1-beta.15, =6.0.1-alpha.2 and more Source cves: CVE-2026-18549 Source advisory:...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to the saveRequestFiles multipart upload handling in index.js. An attacker can hang a request and leave temporary files behind by sending a file part that excee...

CVE-2026-18500

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...

CVE-2026-18165

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

EUVD-2026-59767

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

CVE-2026-18165

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...