Skip to content
Threat Feed
Subscribe

Tag

Fastify

9 briefs RSS
high advisory

Fastify/static Vulnerable to Route Guard Bypass via Path Traversal

The @fastify/static package is vulnerable to a route guard bypass via path traversal using non-leading '..' or '%2E%2E' path segments, allowing attackers to circumvent route-based middleware and access protected files that are served by the static plugin.

@fastify/static fastify nodejs web-vulnerability path-traversal webserver
1r 3t 1c
medium advisory

Fastify accepts-serializer Denial of Service via Unbounded Accept Header Cache Growth

The @fastify/accepts-serializer package is vulnerable to a denial of service (DoS) attack due to unbounded cache growth, where an attacker can send many distinct Accept header variants, causing the cache to grow unbounded, exhausting the Node.js heap, and crashing the process.

@fastify/accepts-serializer dos denial-of-service fastify
2r 1t 1c
high advisory

@fastify/middie Middleware Bypass Vulnerability (CVE-2026-33804)

A middleware bypass vulnerability (CVE-2026-33804) exists in @fastify/middie versions 9.3.1 and earlier when the deprecated Fastify ignoreDuplicateSlashes option is enabled, potentially allowing unauthorized access.

fastify middie middleware bypass cve-2026-33804 defense-evasion
2r 1t 1c
critical advisory

Fastify Proxy Header Stripping Vulnerability

The `@fastify/reply-from` and `@fastify/http-proxy` libraries process the client's `Connection` header after adding headers, allowing attackers to strip proxy-added headers via the `Connection` header, leading to potential bypass of security controls.

fastify header stripping proxy vulnerability
2r 2t
high advisory

Fastify Body Schema Validation Bypass via Leading Space in Content-Type Header

Fastify v5.x is vulnerable to a body schema validation bypass, allowing attackers to circumvent request body validation by prepending a single space to the Content-Type header, potentially compromising data integrity and security constraints.

fastify validation-bypass webserver
2r 1t 2c
critical advisory

@fastify/express Authentication Bypass via URL Normalization Gaps

A vulnerability exists in `@fastify/express` v4.0.4 that allows complete bypass of path-scoped authentication middleware via URL normalization gaps, specifically through duplicate slashes and semicolon delimiters, leading to unauthorized access to protected routes.

@fastify/express fastify express authentication-bypass url-normalization cve-2026-33808
2r 1t 1c
high advisory

@fastify/middie Middleware Bypass Vulnerability via Duplicate Slashes

`@fastify/middie` versions 9.3.1 and earlier are vulnerable to middleware bypass via URLs with duplicate leading slashes due to improper handling of the deprecated `ignoreDuplicateSlashes` option, potentially allowing unauthorized access to protected resources.

Fastify +1 middie middleware-bypass vulnerability defense-evasion
2r 1t 1c
critical advisory

Fastify/Express Middleware Path Doubling Authentication Bypass

A path handling bug in `@fastify/express` v4.0.4 `onRegister` function causes middleware paths to be doubled when inherited by child plugins, resulting in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware.

@fastify/express fastify express authentication-bypass middleware path-traversal
2r 1t
critical advisory

Fastify Middlie Authentication Bypass Vulnerability (CVE-2026-6270)

Fastify middlie versions 9.3.1 and earlier do not properly register inherited middleware, leading to authentication bypass in child plugin scopes, allowing unauthenticated access.

middie fastify middlie authentication bypass cve-2026-6270
2r 1t 1c 1i