fastify

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Denial of Service vulnerability with large JSON payloads in fastify

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

fastify vulnerable to denial of service via malicious Content-Type

Fastify: Incorrect Content-Type parsing can lead to CSRF attack

Fastify's Content-Type header tab character allows body validation bypass

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Denial of service in fastify

Session fixation in fastify-passport

CSRF token fixation in fastify-passport

@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state

Fastify's connection header abuse enables stripping of proxy-added headers

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Cross-site Request Forgery in fastify-csrf

fastify/websocket vulnerable to uncaught exception via crash on malformed packet

@fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

fastify-reply-from affected by bypass of reply forwarding

Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass

Fastify Middie Middleware Path Bypass

Uncaught Exception in fastify-multipart

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

Uncontrolled Resource Consumption in fastify-multipart

@fastify/static vulnerable to path traversal in directory listing

Nest has a Fastify URL Encoding Middleware Bypass

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Lack of protection against cookie tossing attacks in fastify-csrf

Nest Fastify HEAD Request Middleware Bypass

fastify-bearer-auth vulnerable to Timing Attack Vector

URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Malicious code in fastify-tfb (npm)