Fastify
53 CVEs across 30 Fastify products. Browse Fastify vulnerabilities, severities, and proof-of-concept exploits.
Fastify products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-18174 | Medium | 5.3 | 2026-07-29 | @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated en… |
CVE-2026-7120 | Medium | 5.3 | 2026-07-23 | @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Vers… |
CVE-2026-15074 | High | 7.5 | 2026-07-23 | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypas… |
CVE-2026-16117 | Critical | 10.0 | 2026-07-18 | Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL… |
CVE-2026-16158 | High | 8.7 | 2026-07-18 | Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source pat… |
CVE-2026-15631 | High | 8.7 | 2026-07-18 | Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewr… |
CVE-2026-14198 | Critical | 9.1 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underl… |
CVE-2026-14181 | High | 7.5 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malform… |
CVE-2026-6556 | Critical | 9.1 | 2026-06-30 | @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount path… |
CVE-2026-7768 | High | 7.5 | 2026-05-04 | @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenti… |
CVE-2026-33804 | High | 7.4 | 2026-04-16 | @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middle… |
CVE-2026-6410 | Medium | 5.3 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves d… |
CVE-2026-6270 | Critical | 9.1 | 2026-04-16 | @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers… |
CVE-2026-6414 | Medium | 5.9 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as l… |
CVE-2026-33805 | High | 8.6 | 2026-04-15 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own he… |
CVE-2026-33808 | Critical | 9.1 | 2026-04-15 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabl… |
CVE-2026-33807 | Critical | 9.1 | 2026-04-15 | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child… |
CVE-2026-33806 | High | 7.5 | 2026-04-15 | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the… |
CVE-2026-3635 | Medium | 6.1 | 2026-03-23 | Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom fu… |
CVE-2026-3419 | Medium | 5.3 | 2026-03-06 | Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://ht… |
CVE-2026-2880 | Critical | 9.1 | 2026-02-27 | A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('… |
CVE-2026-25224 | Low | 3.7 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response hand… |
CVE-2026-25223 | High | 7.5 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body v… |
CVE-2026-22037 | High | 8.4 | 2026-01-19 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middle… |
CVE-2026-22031 | High | 8.4 | 2026-01-19 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 wh… |
CVE-2025-66415 | Medium | 5.4 | 2025-12-01 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could a… |
CVE-2025-32442 | High | 7.5 | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different valida… |
CVE-2025-24033 | High | 7.5 | 2025-01-23 | @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not dele… |
CVE-2024-35220 | High | 7.4 | 2024-05-21 | @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is… |
CVE-2024-31999 | High | 7.4 | 2024-04-10 | @festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with… |
CVE-2024-22207 | Medium | 5.3 | 2024-01-15 | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will l… |
CVE-2023-51701 | Medium | 5.3 | 2024-01-08 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could mis… |
CVE-2023-31999 | High | 8.8 | 2023-07-04 | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the… |
CVE-2023-29020 | Medium | 6.5 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fas… |
CVE-2023-29019 | High | 8.1 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user… |
CVE-2023-27495 | Medium | 5.3 | 2023-04-20 | @fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection lib… |
CVE-2023-25576 | High | 7.5 | 2023-02-14 | @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of serv… |
CVE-2022-41919 | Medium | 4.2 | 2022-11-22 | Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking… |
CVE-2022-39386 | High | 7.5 | 2022-11-08 | @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All ve… |
CVE-2022-39288 | High | 7.5 | 2022-10-10 | fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content… |
CVE-2022-31142 | High | 7.5 | 2022-07-14 | @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use… |
CVE-2022-29220 | Medium | 6.5 | 2022-05-31 | github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-… |
CVE-2021-23597 | High | 7.5 | 2022-02-11 | This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This… |
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |
CVE-2021-22963 | Medium | 6.1 | 2021-10-14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // fol… |
CVE-2021-29624 | Medium | 6.5 | 2021-05-19 | fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "doubl… |
CVE-2021-21322 | Critical | 10.0 | 2021-03-02 | fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is… |
CVE-2021-21321 | Critical | 10.0 | 2021-03-02 | fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0… |
CVE-2020-28482 | Medium | 5.9 | 2021-01-19 | This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path… |
CVE-2020-8192 | Medium | 6.5 | 2020-07-30 | A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors opt… |
CVE-2020-8136 | High | 7.5 | 2020-03-20 | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a special… |
CVE-2018-3711 | High | 7.5 | 2018-06-07 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large paylo… |