FA
Product
fastify
by fastify · last CVE Oct 13, 2026
18
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 10Medium 6Low 2
Watch

Add fastify to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-41919
8.8
0%
Nov 22
Fastify is a web framework with minimal overhead and plugin architecture
Affected: 3.0.0 before 3.29.4; 4.0.0 before 4.10.2
CVE-2026-84504
8.1
0%
Sep 4
fastify vulnerable to request body replacement via an async validation result collision
Affected: before 5.12.2
CVE-2026-84428
7.5
1%
Sep 4
fastify vulnerable to header validation bypass via incomplete schema case normalization
Affected: before 5.12.2
CVE-2026-84469
7.5
0%
Sep 4
fastify vulnerable to request validation bypass via skipped boolean false schemas
Affected: before 5.12.2
CVE-2026-76169
7.5
1%
Sep 4
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Affected: 4.0.0 before 5.12.2
CVE-2026-33806
7.5
0%
Apr 15
fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Affected: 5.3.2 before 5.8.5
CVE-2026-25223
7.5
1%
Feb 3
Fastify's Content-Type header tab character allows body validation bypass
Affected: < 5.7.2
CVE-2025-32442
7.5
1%
Apr 18
Fastify is a fast and low overhead web framework, for Node.js
Affected: 5.0.0 before 5.3.2; 4.29.0
CVE-2022-39288
7.5
59%
Oct 10
Denial of service in Fastify via Content-Type header
Affected: >= 4.0.0, < 4.8.1
CVE-2018-3711
7.5
2%
Jun 7
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload
Affected: before 0.38.0
Showing 10