Is fastify 5.12 vulnerable?
npm · 8 releases from 5.12.0 to 5.12.7 · latest fastify is 5.12.7 · checked 2 Nov 2026
No known advisories in the last release
fastify 5.12.7, the last 5.12 release, has no known advisories. 8 advisories affect earlier 5.12.x releases, so update to 5.12.7.
npm install fastify@5.12.7Fixed within 5.12.x, affecting earlier releases
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
- Affected
- >=5.12.2 <5.12.6
- Fixed in
- 5.12.6
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- Affected
- <5.12.5
- Fixed in
- 5.12.5
fastify vulnerable to request body replacement via an async validation result collision
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- Affected
- >=4.0.0 <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to request validation bypass via skipped boolean false schemas
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to header validation bypass via incomplete schema case normalization
- Affected
- <5.12.2
- Fixed in
- 5.12.2
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- Affected
- >=5.8.3 <5.12.1
- Fixed in
- 5.12.1
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- Affected
- <5.12.1
- Fixed in
- 5.12.1
Which of your client projects are still on fastify 5.12?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact fastify version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other fastify versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.