Authentication Bypass Using an Alternate Path or Channel

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +3014 more potentially affected by CVE-2026-76169 via fastify (>=4.0.2, <=5.12.1)

fastify NPM version =4.0.2, =1.0.0, =1.0.5, =1.0.3, =0.0.3, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =3.0.0, =0.1.0, =2.0.0, =3.0.0, =0.0.1, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-76169 Source advisory: SNYK:JS-FASTIFY-19639043...

CVE-2026-84428

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428

A flaw was found in fastify. Due to incomplete case normalization of HTTP header names within a route's header schema, specifically within the JSON Schema Draft 7 dependencies keyword, an unauthenticated remote attacker can bypass intended conditional checks. This allows the attacker to send...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the request target evaluation. An attacker can gain unauthorized access to protected routes by crafting requests with absolute-form targets that bypass...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.12.0) +3 more potentially affected by CVE-2026-85184 via @fastify/middie (>=9.1.0, <=9.3.3)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0, =1.0.0-alpha.23, =1.0.0-alpha.29 Source cves: CVE-2026-85184 Source advisory: SNYK:JS-FASTIFYMIDDIE-19643570...

CVE-2026-84469

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...

@agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1), @agent-tool-platform/runtime (>=0.1.0, <=0.1.2) +582 more potentially affected by CVE-2026-84428 via fastify (>=5.0.0, <=5.12.1)

fastify NPM version =5.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-84428 Source advisory: SNYK:JS-FASTIFY-19639042...

CVE-2026-84428

fastify versions before 5.12.2 are vulnerable to a header validation bypass caused by incomplete case normalization in the JSON Schema Draft 7 dependencies keyword. While the library lowercases property keys and the root-level required array to accommodate HTTP's case-insensitive headers, it fail...

Improper Validation of Unsafe Equivalence in Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-76169

A flaw was found in fastify. Malformed URLs can be routed to a custom not-found handler of a different plugin, bypassing the intended security checks. This allows an unauthenticated attacker to access and read the full response of an authentication-protected private fallback, leading to informati...

CVE-2026-84469

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-76169

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

@agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1), @agent-tool-platform/runtime (>=0.1.0, <=0.1.2) +582 more potentially affected by CVE-2026-84469 via fastify (>=5.0.0, <=5.12.1)

fastify NPM version =5.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-84469 Source advisory: SNYK:JS-FASTIFY-19639041...