Known Vulnerabilities for products from Fastify
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Fastify".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-120216 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-120215 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-120214 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-120213 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-117549 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-117531 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-117518 json | Not Provided | 2026-11-02 | 2026-11-02 | |
| CVE-2026-117499 json | Not Provided | 2026-10-27 | 2026-11-04 | |
| CVE-2026-112712 json | Not Provided | 2026-10-20 | 2026-10-30 | |
| CVE-2026-112362 json | Not Provided | 2026-10-27 | 2026-11-04 | |
| CVE-2026-85184 json | @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw r... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-85124 json | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before... | Not Provided | 2026-09-03 | 2026-09-09 |
| CVE-2026-84504 json | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol use... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84469 json | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Dra... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84428 json | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's h... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-76169 json | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found ha... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-74866 json | @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the... | Not Provided | 2026-08-21 | 2026-10-16 |
| CVE-2026-33808 json | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify rout... | Not Provided | 2026-04-15 | 2026-06-17 |
| CVE-2026-33807 json | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to b... | Not Provided | 2026-04-15 | 2026-10-26 |
| CVE-2026-33806 json | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed ent... | Not Provided | 2026-04-15 | 2026-07-15 |
Known software with vulnerabilities from Fastify
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Fastify | Fastify | 0.1.0 |
| Application | Fastify | Fastify-csrf | 1.0.0 |
| Application | Fastify | Fastify-multipart | 0.1.0 |