FA
Vendor
Fastify
76
CVEs
0
On KEV
1
New 30D
Products
FA8.8
fastify
fastify
18 CVEs0 on KEV1 new
FA9.1
Fastify/middie
Fastify
7 CVEs0 on KEV0 new
FA8.8
Fastify-static
Fastify
7 CVEs0 on KEV0 new
FA7.5
fastify-multipart
fastify
6 CVEs0 on KEV0 new
FA9.1
fastify-express
fastify
4 CVEs0 on KEV0 new
FA10.0
Fastify/http-proxy
Fastify
4 CVEs0 on KEV0 new
FA7.5
Fastify/busyboy
Fastify
3 CVEs0 on KEV0 new
FA10.0
fastify-reply-from
fastify
3 CVEs0 on KEV0 new
RE8.6
Reply-from
Fastify
3 CVEs0 on KEV0 new
FA8.8
Fastify-csrf
Fastify
2 CVEs0 on KEV0 new
FA8.1
fastify-passport
fastify
2 CVEs0 on KEV0 new
PA8.1
Passport
Fastify
2 CVEs0 on KEV0 new
BE7.5
Bearer-auth
Fastify
1 CVEs0 on KEV0 new
CS6.5
csrf-protection
fastify
1 CVEs0 on KEV0 new
FA7.5
Fastify/accepts-serializer
Fastify
1 CVEs0 on KEV0 new
FA9.1
Fastify/aws-lambda
Fastify
1 CVEs0 on KEV0 new
FA5.3
Fastify/forwarded
Fastify
1 CVEs0 on KEV0 new
FA8.1
Fastify/jwt
Fastify
1 CVEs0 on KEV0 new
FA5.4
Fastify/oauth2
Fastify
1 CVEs0 on KEV0 new
FA5.3
Fastify/rate-limit
Fastify
1 CVEs0 on KEV0 new
FA7.4
fastify-secure-session
fastify
1 CVEs0 on KEV0 new
FA5.3
fastify-swagger-ui
fastify
1 CVEs0 on KEV0 new
GA6.5
Github Action Merge Dependabot
Fastify
1 CVEs0 on KEV0 new
MI8.8
middie
fastify
1 CVEs0 on KEV0 new
OA8.8
Oauth2
Fastify
1 CVEs0 on KEV0 new
SE7.4
session
fastify
1 CVEs0 on KEV0 new
WE7.5
Websocket
Fastify
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107832 | FA fastify fastify | 3.7 | Oct 13 | fastify vulnerable to header validation bypass via case-sensitive propertyNames |
| CVE-2026-92081 | FA fastify fastify | 5.9 | Sep 16 | fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses |
| CVE-2026-84428 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to header validation bypass via incomplete schema case normalization |
| CVE-2026-84469 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to request validation bypass via skipped boolean false schemas |
| CVE-2026-76169 | FA fastify fastify | 7.5 | Sep 4 | fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers |
| CVE-2026-84504 | FA fastify fastify | 8.1 | Sep 4 | fastify vulnerable to request body replacement via an async validation result collision |
| CVE-2026-85184 | FA Fastify/middie Fastify | 9.1 | Sep 4 | @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target |
| CVE-2026-85124 | FA Fastify/http-proxy Fastify | 7.5 | Sep 3 | @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments |
| CVE-2026-74866 | FA Fastify/busyboy Fastify | 5.8 | Aug 21 | @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name |
| CVE-2026-16732 | FA fastify fastify | 6.1 | Aug 18 | fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count |
| CVE-2026-18504 | FA fastify fastify | 5.3 | Aug 18 | fastify vulnerable to schema validation bypass via root primitive coercion mismatch |
| CVE-2026-18165 | FA Fastify/oauth2 Fastify | 5.4 | Aug 15 | @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies |
| CVE-2026-19474 | FA Fastify-multipart Fastify | 7.5 | Aug 15 | @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload |
| CVE-2026-18549 | FA Fastify-multipart Fastify | 7.5 | Aug 15 | @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit |
| CVE-2026-18500 | FA Fastify/jwt Fastify | 8.1 | Aug 15 | @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key |
| CVE-2026-19484 | FA Fastify/busyboy Fastify | 7.5 | Aug 13 | @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary |
| CVE-2026-19481 | FA Fastify/busyboy Fastify | 7.5 | Aug 13 | @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header |
| CVE-2026-18427 | FA Fastify-static Fastify | 7.5 | Aug 6 | @fastify/static vulnerable to route guard bypass via non-canonical path segments |
| CVE-2026-18248 | FA Fastify/aws-lambda Fastify | 9.1 | Aug 3 | @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header |
| CVE-2026-15144 | FA Fastify/rate-limit Fastify | 5.3 | Jul 29 | @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation |
| CVE-2026-18174 | FA Fastify/forwarded Fastify | 5.3 | Jul 29 | @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For |
| CVE-2026-15074 | FA Fastify-static Fastify | 7.5 | Jul 23 | @fastify/static vulnerable to route guard bypass via path traversal |
| CVE-2026-7120 | FA Fastify-static Fastify | 5.3 | Jul 23 | @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths |
| CVE-2026-16117 | FA Fastify/http-proxy Fastify | 10.0 | Jul 18 | @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters |
| CVE-2026-15631 | FA Fastify/http-proxy Fastify | 10.0 | Jul 18 | @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal |
| CVE-2026-16158 | FA Fastify/reply-from Fastify | 10.0 | Jul 18 | @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision |
| CVE-2026-14181 | FA Fastify/middie Fastify | 7.5 | Jul 1 | @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths |
| CVE-2026-14198 | FA Fastify/middie Fastify | 9.1 | Jul 1 | @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values |
| CVE-2026-6556 | FA Fastify/express Fastify | 9.1 | Jun 30 | @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins |
| CVE-2026-7768 | FA Fastify/accepts-serializer Fastify | 7.5 | May 4 | @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth |
| CVE-2026-33804 | FA Fastify/middie Fastify | 9.1 | Apr 16 | @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option |
| CVE-2026-6270 | FA Fastify/middie Fastify | 9.1 | Apr 16 | @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes |
| CVE-2026-6410 | FA Fastify-static Fastify | 5.3 | Apr 16 | @fastify/static vulnerable to path traversal in directory listing |
| CVE-2026-6414 | FA Fastify-static Fastify | 5.9 | Apr 16 | @fastify/static vulnerable to route guard bypass via encoded path separators |
| CVE-2026-33805 | FA Fastify/http-proxy Fastify | 8.6 | Apr 15 | @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers |
| CVE-2026-33807 | FA @fastify/express fastify | 9.1 | Apr 15 | @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes |
| CVE-2026-33808 | FA @fastify/express fastify | 9.1 | Apr 15 | @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) |
| CVE-2026-33806 | FA fastify fastify | 7.5 | Apr 15 | fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header |
| CVE-2026-3635 | FA fastify fastify | 6.1 | Mar 23 | Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function |
| CVE-2026-3419 | FA fastify fastify | 5.3 | Mar 6 | Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation |
| CVE-2026-2880 | FA Fastify/middie Fastify | 9.1 | Feb 27 | @fastify/middie has an improper path normalization vulnerability |
| CVE-2026-25223 | FA fastify fastify | 7.5 | Feb 3 | Fastify's Content-Type header tab character allows body validation bypass |
| CVE-2026-25224 | FA fastify fastify | 3.7 | Feb 3 | Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream |
| CVE-2026-22037 | FA fastify-express fastify | 8.4 | Jan 19 | @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) |
| CVE-2026-22031 | MI middie fastify | 8.8 | Jan 19 | Fastify Middie Middleware Path Bypass |
| CVE-2025-66415 | FA fastify-reply-from fastify | 5.4 | Dec 1 | fastify-reply-from bypass of reply forwarding |
| CVE-2025-32442 | FA fastify fastify | 7.5 | Apr 18 | Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass |
| CVE-2025-24033 | FA fastify-multipart fastify | 7.5 | Jan 23 | @fastify/multipart vulnerable to unlimited consumption of resources |
| CVE-2024-35220 | SE session fastify | 7.4 | May 21 | @fastify/session reuses destroyed session cookie |
| CVE-2024-31999 | FA fastify-secure-session fastify | 7.4 | Apr 10 | @fastify/secure-session: Reuse of destroyed secure session cookie |
| CVE-2024-22207 | FA fastify-swagger-ui fastify | 5.3 | Jan 15 | Default swagger-ui configuration exposes all files in the module |
| CVE-2023-51701 | FA fastify-reply-from fastify | 7.5 | Jan 8 | @fastify-reply-from JSON Content-Type parsing confusion |
| CVE-2023-31999 | OA Oauth2 Fastify | 8.8 | Jul 4 | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users |
| CVE-2023-29020 | FA fastify-passport fastify | 6.5 | Apr 21 | Cross site request forgery token fixation in fastify-passport |
| CVE-2023-29019 | FA fastify-passport fastify | 8.1 | Apr 21 | Session fixation in fastify-passport |
| CVE-2023-27495 | CS csrf-protection fastify | 6.5 | Apr 20 | Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection |
| CVE-2023-25576 | FA fastify-multipart fastify | 7.5 | Feb 14 | @fastify/multipart vulnerable to DoS due to unlimited number of parts |
| CVE-2022-41919 | FA fastify fastify | 8.8 | Nov 22 | Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type |
| CVE-2022-39386 | WE Websocket Fastify | 7.5 | Nov 8 | @fastify/websocket provides WebSocket support for Fastify |
| CVE-2022-39288 | FA fastify fastify | 7.5 | Oct 10 | Denial of service in Fastify via Content-Type header |