Known Vulnerabilities for products from Fastify
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Fastify".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-92395 json | Not Provided | 2026-09-16 | 2026-09-17 | |
| CVE-2026-92087 json | Not Provided | 2026-09-16 | 2026-09-17 | |
| CVE-2026-92081 json | Not Provided | 2026-09-16 | 2026-09-16 | |
| CVE-2026-90982 json | Not Provided | 2026-09-17 | 2026-09-17 | |
| CVE-2026-86818 json | Not Provided | 2026-09-15 | 2026-09-15 | |
| CVE-2026-86472 json | Not Provided | 2026-09-15 | 2026-09-15 | |
| CVE-2026-85184 json | @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw r... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-85124 json | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before... | Not Provided | 2026-09-03 | 2026-09-09 |
| CVE-2026-84504 json | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol use... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84469 json | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Dra... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84428 json | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's h... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-76169 json | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found ha... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-74866 json | @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the... | Not Provided | 2026-08-21 | 2026-09-08 |
| CVE-2026-33808 json | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify rout... | Not Provided | 2026-04-15 | 2026-06-01 |
| CVE-2026-33807 json | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to b... | Not Provided | 2026-04-15 | 2026-06-01 |
| CVE-2026-33806 json | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed ent... | Not Provided | 2026-04-15 | 2026-07-15 |
| CVE-2026-33805 json | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header af... | Not Provided | 2026-04-15 | 2026-07-15 |
| CVE-2026-33804 json | @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSla... | Not Provided | 2026-04-16 | 2026-05-14 |
| CVE-2026-25223 json | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exis... | Not Provided | 2026-02-03 | 2026-07-15 |
| CVE-2026-22031 json | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastif... | Not Provided | 2026-01-19 | 2026-05-14 |
Known software with vulnerabilities from Fastify
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Fastify | Fastify | 0.1.0 |
| Application | Fastify | Fastify-csrf | 1.0.0 |
| Application | Fastify | Fastify-multipart | 0.1.0 |