Is fastify 3.21 vulnerable?
npm · 7 releases from 3.21.0 to 3.21.6 · latest fastify is 5.12.8 · checked 2 Nov 2026
Yes: 9 known advisories
Yes. fastify 3.21.6, the last 3.21 release, is affected by 9 known security advisories (4 high, 4 medium, 1 low), including CVE-2026-84504, CVE-2026-84469, CVE-2026-84428. Upgrade to 5.12.5 or later to fix all of them.
npm install fastify@5.12.5Advisories affecting fastify 3.21.6
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- Affected
- <5.12.5
- Fixed in
- 5.12.5
fastify vulnerable to request body replacement via an async validation result collision
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to request validation bypass via skipped boolean false schemas
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to header validation bypass via incomplete schema case normalization
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- Affected
- <5.12.1
- Fixed in
- 5.12.1
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
- Affected
- <5.8.3
- Fixed in
- 5.8.3
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
- Affected
- <5.7.3
- Fixed in
- 5.7.3
Fastify's Content-Type header tab character allows body validation bypass
- Affected
- <5.7.2
- Fixed in
- 5.7.2
Fastify: Incorrect Content-Type parsing can lead to CSRF attack
- Affected
- >=4.0.0 <4.10.2 · >=3.0.0 <3.29.4
- Fixed in
- 3.29.4, 4.10.2
Which of your client projects are still on fastify 3.21?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact fastify version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other fastify versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.