fastify vulnerabilities

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Affected

>=5.12.2 <5.12.6

Fixed in

5.12.6

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Affected

<5.12.5

Fixed in

5.12.5

fastify vulnerable to request body replacement via an async validation result collision

Affected

<5.12.2

Fixed in

5.12.2

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Affected

>=4.0.0 <5.12.2

Fixed in

5.12.2

fastify vulnerable to request validation bypass via skipped boolean false schemas

Affected

<5.12.2

Fixed in

5.12.2

fastify vulnerable to header validation bypass via incomplete schema case normalization

Affected

<5.12.2

Fixed in

5.12.2

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Affected

>=5.8.3 <5.12.1

Fixed in

5.12.1

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

Affected

<5.12.1

Fixed in

5.12.1

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

Affected

>=5.3.2 <5.8.5

Fixed in

5.8.5

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Affected

<5.8.3

Fixed in

5.8.3

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Affected

>=5.7.2 <5.8.1

Fixed in

5.8.1

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Affected

<5.7.3

Fixed in

5.7.3

Fastify's Content-Type header tab character allows body validation bypass

Affected

<5.7.2

Fixed in

5.7.2

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Affected

>=5.0.0 <5.3.2 · >=4.29.0 <4.29.1

Fixed in

4.29.1, 5.3.2

Fastify: Incorrect Content-Type parsing can lead to CSRF attack

Affected

>=4.0.0 <4.10.2 · >=3.0.0 <3.29.4

Fixed in

3.29.4, 4.10.2

fastify vulnerable to denial of service via malicious Content-Type

Affected

>=4.0.0 <4.8.1

Fixed in

4.8.1

Denial of service in fastify

Affected

<2.15.1

Fixed in

2.15.1

Denial of Service vulnerability with large JSON payloads in fastify

Affected

<0.38.0

Fixed in

0.38.0