fastify

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Denial of Service vulnerability with large JSON payloads in fastify

Fastify: Incorrect Content-Type parsing can lead to CSRF attack

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

fastify vulnerable to denial of service via malicious Content-Type

Fastify's Content-Type header tab character allows body validation bypass

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Denial of service in fastify

Session fixation in fastify-passport

@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state

Fastify's connection header abuse enables stripping of proxy-added headers

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Cross-site Request Forgery in fastify-csrf

@fastify/static vulnerable to route guard bypass via encoded path separators

fastify-reply-from affected by bypass of reply forwarding

fastify/websocket vulnerable to uncaught exception via crash on malformed packet

Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass

Fastify Middie Middleware Path Bypass

Uncaught Exception in fastify-multipart

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

Uncontrolled Resource Consumption in fastify-multipart

@fastify/static vulnerable to path traversal in directory listing

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

Lack of protection against cookie tossing attacks in fastify-csrf

Nest has a Fastify URL Encoding Middleware Bypass

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

CSRF token fixation in fastify-passport

Nest Fastify HEAD Request Middleware Bypass

Malicious code in fastify-tfb (npm)

fastify-bearer-auth vulnerable to Timing Attack Vector

Nest: Middleware Bypass on Fastify via Trailing Slash

Malicious code in plugin-fastify (npm)

Malicious code in fastify-addon (npm)

Malicious code in @mastra/fastify (npm)

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)