fastify fastify vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20251
3. 202614

Newest CVEs

• CVE-2026-120216

  fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

  fastify · fastify

  Medium5.9
• CVE-2026-107832

  fastify vulnerable to header validation bypass via case-sensitive propertyNames

  fastify · fastify

  Low3.7
• CVE-2026-92081

  fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

  fastify · fastify

  Medium5.9
• CVE-2026-84428

  fastify vulnerable to header validation bypass via incomplete schema case normalization

  fastify · fastify

  High7.5
• CVE-2026-84469

  fastify vulnerable to request validation bypass via skipped boolean false schemas

  fastify · fastify

  High7.5
• CVE-2026-76169

  fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

  fastify · fastify

  High7.5
• CVE-2026-84504

  fastify vulnerable to request body replacement via an async validation result collision

  fastify · fastify

  High8.1
• CVE-2026-16732

  fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

  fastify · fastify

  Medium6.1
• CVE-2026-18504

  fastify vulnerable to schema validation bypass via root primitive coercion mismatch

  fastify · fastify

  Medium5.4
• CVE-2026-33806

  fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

  fastify · fastify

  High7.5