FA
Vendor
Fastify
66
CVEs
0
On KEV
1
New 30D
Products
FA8.8
fastify
fastify
18 CVEs0 on KEV1 new
FA9.1
Fastify/middie
Fastify
7 CVEs0 on KEV0 new
FA8.8
Fastify-static
Fastify
7 CVEs0 on KEV0 new
FA7.5
Fastify-multipart
Fastify
5 CVEs0 on KEV0 new
FA10.0
Fastify/http-proxy
Fastify
4 CVEs0 on KEV0 new
FA7.5
Fastify/busyboy
Fastify
3 CVEs0 on KEV0 new
FA9.1
@fastify/express
fastify
3 CVEs0 on KEV0 new
RE8.6
Reply-from
Fastify
3 CVEs0 on KEV0 new
FA8.8
Fastify-csrf
Fastify
2 CVEs0 on KEV0 new
PA8.1
Passport
Fastify
2 CVEs0 on KEV0 new
BE7.5
Bearer-auth
Fastify
1 CVEs0 on KEV0 new
CS6.5
Csrf-protection
Fastify
1 CVEs0 on KEV0 new
FA7.5
Fastify/accepts-serializer
Fastify
1 CVEs0 on KEV0 new
FA9.1
Fastify/aws-lambda
Fastify
1 CVEs0 on KEV0 new
FA5.3
Fastify/forwarded
Fastify
1 CVEs0 on KEV0 new
FA8.1
Fastify/jwt
Fastify
1 CVEs0 on KEV0 new
FA5.4
Fastify/oauth2
Fastify
1 CVEs0 on KEV0 new
FA5.3
Fastify/rate-limit
Fastify
1 CVEs0 on KEV0 new
FA10.0
Fastify/reply-from
Fastify
1 CVEs0 on KEV0 new
GA6.5
Github Action Merge Dependabot
Fastify
1 CVEs0 on KEV0 new
OA8.8
Oauth2
Fastify
1 CVEs0 on KEV0 new
WE7.5
Websocket
Fastify
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107832 | FA fastify fastify | 3.7 | Oct 13 | fastify vulnerable to header validation bypass via case-sensitive propertyNames |
| CVE-2026-92081 | FA fastify fastify | 5.9 | Sep 16 | fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses |
| CVE-2026-84428 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to header validation bypass via incomplete schema case normalization |
| CVE-2026-84469 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to request validation bypass via skipped boolean false schemas |
| CVE-2026-76169 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers |
| CVE-2026-84504 | FA fastify fastify | 8.1 | Sep 4 | fastify vulnerable to request body replacement via an async validation result collision |
| CVE-2026-85184 | FA Fastify/middie Fastify | 9.1 | Sep 4 | @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target |
| CVE-2026-85124 | FA Fastify/http-proxy Fastify | 7.5 | Sep 3 | @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments |
| CVE-2026-74866 | FA Fastify/busyboy Fastify | 5.8 | Aug 21 | @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name |
| CVE-2026-16732 | FA fastify fastify | 6.1 | Aug 18 | fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count |
| CVE-2026-18504 | FA fastify fastify | 5.3 | Aug 18 | fastify vulnerable to schema validation bypass via root primitive coercion mismatch |
| CVE-2026-18165 | FA Fastify/oauth2 Fastify | 5.4 | Aug 15 | @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies |
| CVE-2026-19474 | FA Fastify-multipart Fastify | 7.5 | Aug 15 | @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload |
| CVE-2026-18549 | FA Fastify-multipart Fastify | 7.5 | Aug 15 | @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit |
| CVE-2026-18500 | FA Fastify/jwt Fastify | 8.1 | Aug 15 | @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key |
| CVE-2026-19484 | FA Fastify/busyboy Fastify | 7.5 | Aug 13 | @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary |
| CVE-2026-19481 | FA Fastify/busyboy Fastify | 7.5 | Aug 13 | @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header |
| CVE-2026-18427 | FA Fastify-static Fastify | 7.5 | Aug 6 | @fastify/static vulnerable to route guard bypass via non-canonical path segments |
| CVE-2026-18248 | FA Fastify/aws-lambda Fastify | 9.1 | Aug 3 | @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header |
| CVE-2026-15144 | FA Fastify/rate-limit Fastify | 5.3 | Jul 29 | @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation |
| CVE-2026-18174 | FA Fastify/forwarded Fastify | 5.3 | Jul 29 | @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For |
| CVE-2026-15074 | FA Fastify-static Fastify | 7.5 | Jul 23 | @fastify/static vulnerable to route guard bypass via path traversal |
| CVE-2026-7120 | FA Fastify-static Fastify | 5.3 | Jul 23 | @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths |
| CVE-2026-16117 | FA Fastify/http-proxy Fastify | 10.0 | Jul 18 | @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters |
| CVE-2026-15631 | FA Fastify/http-proxy Fastify | 10.0 | Jul 18 | @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal |
| CVE-2026-16158 | FA Fastify/reply-from Fastify | 10.0 | Jul 18 | @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision |
| CVE-2026-14181 | FA Fastify/middie Fastify | 7.5 | Jul 1 | @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths |
| CVE-2026-14198 | FA Fastify/middie Fastify | 9.1 | Jul 1 | @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values |
| CVE-2026-6556 | FA Fastify/express Fastify | 9.1 | Jun 30 | @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins |
| CVE-2026-7768 | FA Fastify/accepts-serializer Fastify | 7.5 | May 4 | @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth |
| CVE-2026-33804 | FA Fastify/middie Fastify | 9.1 | Apr 16 | @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option |
| CVE-2026-6270 | FA Fastify/middie Fastify | 9.1 | Apr 16 | @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes |
| CVE-2026-6410 | FA Fastify-static Fastify | 5.3 | Apr 16 | @fastify/static vulnerable to path traversal in directory listing |
| CVE-2026-6414 | FA Fastify-static Fastify | 5.9 | Apr 16 | @fastify/static vulnerable to route guard bypass via encoded path separators |
| CVE-2026-33805 | RE Reply-from Fastify | 8.6 | Apr 15 | @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers |
| CVE-2026-33807 | FA @fastify/express fastify | 9.1 | Apr 15 | @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes |
| CVE-2026-33808 | FA @fastify/express fastify | 9.1 | Apr 15 | @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) |
| CVE-2026-33806 | FA fastify fastify | 7.5 | Apr 15 | fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header |
| CVE-2026-3635 | FA fastify fastify | 6.1 | Mar 23 | Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function |
| CVE-2026-3419 | FA fastify fastify | 5.3 | Mar 6 | Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation |
| CVE-2026-2880 | FA Fastify/middie Fastify | 9.1 | Feb 27 | @fastify/middie has an improper path normalization vulnerability |
| CVE-2026-25223 | FA fastify fastify | 7.5 | Feb 3 | Fastify's Content-Type header tab character allows body validation bypass |
| CVE-2026-25224 | FA fastify fastify | 3.7 | Feb 3 | Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream |
| CVE-2026-22031 | FA Fastify/middie Fastify | 8.8 | Jan 19 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify |
| CVE-2025-66415 | RE Reply-from Fastify | 5.4 | Dec 1 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server |
| CVE-2025-32442 | FA Fastify Fastify | 7.5 | Apr 18 | Fastify is a fast and low overhead web framework, for Node.js |
| CVE-2023-51701 | RE Reply-from Fastify | 7.5 | Jan 8 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server |
| CVE-2023-31999 | OA Oauth2 Fastify | 8.8 | Jul 4 | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users |
| CVE-2023-29020 | PA Passport Fastify | 6.5 | Apr 21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem |
| CVE-2023-29019 | PA Passport Fastify | 8.1 | Apr 21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem |
| CVE-2023-27495 | CS Csrf-protection Fastify | 6.5 | Apr 20 | @fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks |
| CVE-2023-25576 | FA Fastify-multipart Fastify | 7.5 | Feb 14 | @fastify/multipart is a Fastify plugin to parse the multipart content-type |
| CVE-2022-41919 | FA Fastify Fastify | 8.8 | Nov 22 | Fastify is a web framework with minimal overhead and plugin architecture |
| CVE-2022-39386 | WE Websocket Fastify | 7.5 | Nov 8 | @fastify/websocket provides WebSocket support for Fastify |
| CVE-2022-39288 | FA fastify fastify | 7.5 | Oct 10 | Denial of service in Fastify via Content-Type header |
| CVE-2022-31142 | BE Bearer-auth Fastify | 7.5 | Jul 14 | @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers |
| CVE-2022-29220 | GA Github Action Merge Dependabot Fastify | 6.5 | May 31 | github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs) |
| CVE-2021-23597 | FA Fastify-multipart Fastify | 7.5 | Feb 11 | This affects the package fastify-multipart before 5.3.1 |
| CVE-2021-22964 | FA Fastify-static Fastify | 8.8 | Oct 14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double… |
| CVE-2021-22963 | FA Fastify-static Fastify | 6.1 | Oct 14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain:… |