Fastify

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Bec

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segme

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by conca

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket desti

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching m

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argu

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplica

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option.

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instance

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution,

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection head

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypasse

Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1'

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-sc

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @f