fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

EUVD-2026-70998

fastify vulnerable to header validation bypass via incomplete schema case normalization...

fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

CVE-2026-18165

A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery CSRF attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an...

CLSA-2026-1790110789 TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.2...

CLSA-2026-1789917910 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.6...

CLSA-2026-1789906142 TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.1...

CLSA-2026-1789896356 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.3...

CLSA-2026-1789896330 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.1...

PT-2026-103481

TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.6...

PT-2026-103474

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.3...

PT-2026-103473

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.1...

PT-2026-103480

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.1...

CLSA-2026-1789755224 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.7.4-tuxcare.2...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

CVE-2026-85124

A flaw was found in @fastify/http-proxy. This component, designed to proxy HTTP requests, does not correctly validate incoming request paths, specifically failing to account for backslash-based dot-segments. An unauthenticated network attacker can exploit this vulnerability to bypass the proxy's...

Improper Handling of Case Sensitivity

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the route matching process. An attacker can access protected files by altering the letter case of a path segment in a...