Known Vulnerabilities for products from Fastify
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Fastify".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-74866 json | Not Provided | 2026-08-21 | 2026-08-21 | |
| CVE-2026-54281 json | Not Provided | 2026-06-22 | 2026-06-24 | |
| CVE-2026-48714 json | Not Provided | 2026-06-15 | 2026-06-16 | |
| CVE-2026-33808 json | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify rout... | Not Provided | 2026-04-15 | 2026-06-01 |
| CVE-2026-33807 json | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to b... | Not Provided | 2026-04-15 | 2026-06-01 |
| CVE-2026-33806 json | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed ent... | Not Provided | 2026-04-15 | 2026-07-15 |
| CVE-2026-33805 json | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header af... | Not Provided | 2026-04-15 | 2026-07-15 |
| CVE-2026-33804 json | @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSla... | Not Provided | 2026-04-16 | 2026-05-14 |
| CVE-2026-25223 json | Not Provided | 2026-02-03 | 2026-07-15 | |
| CVE-2026-22031 json | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastif... | Not Provided | 2026-01-19 | 2026-05-14 |
| CVE-2026-19484 json | Not Provided | 2026-08-13 | 2026-08-13 | |
| CVE-2026-19481 json | Not Provided | 2026-08-13 | 2026-08-13 | |
| CVE-2026-19474 json | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, reques... | Not Provided | 2026-08-15 | 2026-09-02 |
| CVE-2026-18549 json | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when t... | Not Provided | 2026-08-15 | 2026-09-02 |
| CVE-2026-18504 json | fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema vali... | Not Provided | 2026-08-18 | 2026-09-02 |
| CVE-2026-18174 json | @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header conta... | Not Provided | 2026-07-29 | 2026-08-05 |
| CVE-2026-16732 json | fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarde... | Not Provided | 2026-08-18 | 2026-09-02 |
| CVE-2026-16158 json | Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenat... | Not Provided | 2026-07-18 | 2026-08-05 |
| CVE-2026-16117 json | Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is... | Not Provided | 2026-07-18 | 2026-07-28 |
| CVE-2026-15631 json | Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destinatio... | Not Provided | 2026-07-18 | 2026-07-28 |
Known software with vulnerabilities from Fastify
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Fastify | Fastify | 0.1.0 |
| Application | Fastify | Fastify-csrf | 1.0.0 |
| Application | Fastify | Fastify-multipart | 0.1.0 |