npm/fastify

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

Modified: 7/8/2026

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Modified: 10/22/2026

Fastify: Incorrect Content-Type parsing can lead to CSRF attack

Modified: 11/8/2023

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Modified: 9/2/2026

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Modified: 3/25/2026

fastify vulnerable to denial of service via malicious Content-Type

Modified: 11/8/2023

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Modified: 10/1/2026

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Modified: 7/8/2026

fastify vulnerable to request body replacement via an async validation result collision

Modified: 10/1/2026

fastify vulnerable to header validation bypass via incomplete schema case normalization

Modified: 10/1/2026

fastify vulnerable to request validation bypass via skipped boolean false schemas

Modified: 10/1/2026

Fastify's Content-Type header tab character allows body validation bypass

Modified: 2/4/2026

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Modified: 7/8/2026

Denial of Service vulnerability with large JSON payloads in fastify

Modified: 11/8/2023

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Modified: 2/4/2026

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Modified: 10/1/2026

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

Modified: 9/2/2026

Denial of service in fastify

Modified: 11/8/2023