FA
Product
fastify
18
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 10Medium 6Low 2
Watch
Add fastify to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-41919 | 8.8 | Nov 22 | Fastify is a web framework with minimal overhead and plugin architecture Affected: 3.0.0 before 3.29.4; 4.0.0 before 4.10.2 |
| CVE-2026-84504 | 8.1 | Sep 4 | fastify vulnerable to request body replacement via an async validation result collision Affected: before 5.12.2 |
| CVE-2026-84428 | 7.5 | Sep 4 | fastify vulnerable to header validation bypass via incomplete schema case normalization Affected: before 5.12.2 |
| CVE-2026-84469 | 7.5 | Sep 4 | fastify vulnerable to request validation bypass via skipped boolean false schemas Affected: before 5.12.2 |
| CVE-2026-76169 | 7.5 | Sep 4 | fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers Affected: 4.0.0 before 5.12.2 |
| CVE-2026-33806 | 7.5 | Apr 15 | fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header Affected: 5.3.2 before 5.8.5 |
| CVE-2026-25223 | 7.5 | Feb 3 | Fastify's Content-Type header tab character allows body validation bypass Affected: < 5.7.2 |
| CVE-2025-32442 | 7.5 | Apr 18 | Fastify is a fast and low overhead web framework, for Node.js Affected: 5.0.0 before 5.3.2; 4.29.0 |
| CVE-2022-39288 | 7.5 | Oct 10 | Denial of service in Fastify via Content-Type header Affected: >= 4.0.0, < 4.8.1 |
| CVE-2018-3711 | 7.5 | Jun 7 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload Affected: before 0.38.0 |
Showing 10
