Fastify — CVE history (npm)
Fastify
17 CVEs affect the Fastify npm package (highest CVSS 8.1). Latest disclosed: 2026-09-16. Full CVE history sourced from NVD.
Summary
- Package
Fastify(npm)- Total CVEs
17- Actively exploited (CISA KEV)
- 0
- Highest CVSS
8.1- Latest disclosed
- 2026-09-16
Recent CVEs (top 17)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-92081 | Medium | 5.9 | — | 2026-09-16 | fastify is a fast and low-overhead web framework for Node.js. |
CVE-2026-84428 | High | 7.5 | — | 2026-09-04 | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the… |
CVE-2026-84504 | High | 8.1 | — | 2026-09-04 | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. |
CVE-2026-84469 | High | 7.5 | — | 2026-09-04 | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. |
CVE-2026-76169 | High | 7.5 | — | 2026-09-04 | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. |
CVE-2026-18504 | Medium | 5.4 | — | 2026-08-18 | fastify is a fast and low overhead web framework for Node.js. |
CVE-2026-16732 | Medium | 6.1 | — | 2026-08-18 | fastify is a fast and low overhead web framework for Node.js. |
CVE-2026-33806 | High | 7.5 | — | 2026-04-15 | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. |
CVE-2026-3635 | Medium | 6.1 | — | 2026-03-23 | Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto an… |
CVE-2026-3419 | Medium | 5.3 | — | 2026-03-06 | Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). |
CVE-2026-25224 | Low | 3.7 | — | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. |
CVE-2026-25223 | High | 7.5 | — | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. |
CVE-2025-32442 | High | 7.5 | — | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. |
CVE-2022-41919 | Medium | 4.2 | — | 2022-11-22 | Fastify is a web framework with minimal overhead and plugin architecture. |
CVE-2022-39288 | High | 7.5 | — | 2022-10-10 | fastify is a fast and low overhead web framework, for Node.js. |
CVE-2020-8192 | Medium | 6.5 | — | 2020-07-30 | A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas. |
CVE-2018-3711 | High | 7.5 | — | 2018-06-07 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-84504 | High | 8.1 | — | 2026-09-04 | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. |
CVE-2026-84428 | High | 7.5 | — | 2026-09-04 | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the… |
CVE-2026-84469 | High | 7.5 | — | 2026-09-04 | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. |
CVE-2026-76169 | High | 7.5 | — | 2026-09-04 | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. |
CVE-2026-33806 | High | 7.5 | — | 2026-04-15 | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. |
CVE-2026-25223 | High | 7.5 | — | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. |
CVE-2025-32442 | High | 7.5 | — | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. |
CVE-2022-39288 | High | 7.5 | — | 2022-10-10 | fastify is a fast and low overhead web framework, for Node.js. |
CVE-2018-3711 | High | 7.5 | — | 2018-06-07 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload. |
CVE-2020-8192 | Medium | 6.5 | — | 2020-07-30 | A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas. |