fastify vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20225
3. 20234
4. 20244
5. 20253
6. 202618

Newest CVEs

• CVE-2026-120216

  fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

  fastify · fastify

  Medium5.9
• CVE-2026-107832

  fastify vulnerable to header validation bypass via case-sensitive propertyNames

  fastify · fastify

  Low3.7
• CVE-2026-92081

  fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

  fastify · fastify

  Medium5.9
• CVE-2026-84428

  fastify vulnerable to header validation bypass via incomplete schema case normalization

  fastify · fastify

  High7.5
• CVE-2026-84469

  fastify vulnerable to request validation bypass via skipped boolean false schemas

  fastify · fastify

  High7.5
• CVE-2026-76169

  fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

  fastify · fastify

  High7.5
• CVE-2026-84504

  fastify vulnerable to request body replacement via an async validation result collision

  fastify · fastify

  High8.1
• CVE-2026-16732

  fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

  fastify · fastify

  Medium6.1
• CVE-2026-18504

  fastify vulnerable to schema validation bypass via root primitive coercion mismatch

  fastify · fastify

  Medium5.4
• CVE-2026-33807

  @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

  fastify · @fastify/express

  Critical9.1