fastify vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, bHigh 7.5 · Sep 4, 2026
• CVE-2026-84504 fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers.High 8.1 · Sep 4, 2026
• CVE-2026-84469 fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as aHigh 7.5 · Sep 4, 2026
• CVE-2026-76169 fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling pluginHigh 7.5 · Sep 4, 2026
• CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enableCritical 9.1 · Apr 15, 2026
• CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child pCritical 9.1 · Apr 15, 2026
• CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the High 7.5 · Apr 15, 2026
• CVE-2026-25223 Fastify is a fast and low overhead web framework, for Node.js.High 7.5 · Feb 3, 2026
• CVE-2026-22037 The @fastify/express plugin adds full Express compatibility to Fastify.High 8.4 · Jan 19, 2026
• CVE-2026-22031 @fastify/middie is the plugin that adds middleware support on steroids to Fastify.High 8.4 · Jan 19, 2026
• CVE-2025-32442 Fastify is a fast and low overhead web framework, for Node.js.High 7.5 · Apr 18, 2025
• CVE-2025-24033 @fastify/multipart is a Fastify plugin for parsing the multipart content-type.High 7.5 · Jan 23, 2025
• CVE-2024-35220 @fastify/session is a session plugin for fastify.High 7.4 · May 21, 2024
• CVE-2024-31999 @festify/secure-session creates a secure stateless cookie session for Fastify.High 7.4 · Apr 10, 2024
• CVE-2023-29019 @fastify/passport is a port of passport authentication library for the Fastify ecosystem.High 8.1 · Apr 21, 2023
• CVE-2023-25576 @fastify/multipart is a Fastify plugin to parse the multipart content-type.High 7.5 · Feb 14, 2023
• CVE-2022-39386 @fastify/websocket provides WebSocket support for Fastify.High 7.5 · Nov 8, 2022
• CVE-2022-39288 fastify is a fast and low overhead web framework, for Node.js.High 7.5 · Oct 10, 2022
• CVE-2022-31142 @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers.High 7.5 · Jul 14, 2022
• CVE-2021-23597 This affects the package fastify-multipart before 5.3.1.High 7.5 · Feb 11, 2022
• CVE-2021-22964 A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websHigh 8.8 · Oct 14, 2021
• CVE-2021-21322 fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks.Critical 10 · Mar 1, 2021
• CVE-2021-21321 fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server.Critical 10 · Mar 1, 2021
• CVE-2020-8136 Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a speciallHigh 7.5 · Mar 20, 2020