fastify (npm)
Advisories
20
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.12.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install fastify@5.12.6yarn
yarn add fastify@5.12.6pnpm
pnpm add fastify@5.12.6Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-389g-gv7q-r4x8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames |
Low EPSS 0.26% |
>= 5.12.2, < 5.12.6 | 5.12.6 |
| GHSA-4mh8-r7rc-xpvc fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses |
Medium EPSS 0.41% |
< 5.12.5 | 5.12.5 |
| GHSA-9q9j-q6p8-xq58 fastify vulnerable to header validation bypass via incomplete schema case normalization |
High EPSS 0.52% |
< 5.12.2 | 5.12.2 |
| GHSA-667r-xxjv-c9mm fastify vulnerable to request body replacement via an async validation result collision |
High EPSS 0.43% |
< 5.12.2 | 5.12.2 |
| GHSA-hwr6-493r-vm6h fastify vulnerable to request validation bypass via skipped boolean false schemas |
High EPSS 0.49% |
< 5.12.2 | 5.12.2 |
| GHSA-p68q-wchp-6fh7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers |
High EPSS 0.53% |
>= 4.0.0, < 5.12.2 | 5.12.2 |
| GHSA-w2qp-rph6-63g4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch |
Medium EPSS 0.28% |
< 5.12.1 | 5.12.1 |
| GHSA-3m5p-2c4r-xxw2 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count |
Medium EPSS 0.16% |
>= 5.8.3, < 5.12.1 | 5.12.1 |
| GHSA-444r-cwp2-x5xf fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections |
Medium EPSS 0.16% |
< 5.8.3 | 5.8.3 |
| GHSA-573f-x89g-hqp9 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation |
Medium EPSS 0.36% |
>= 5.7.2, < 5.8.1 | 5.8.1 |
| GHSA-mrq3-vjjr-p77c Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream |
Low EPSS 0.55% |
< 5.7.3 | 5.7.3 |
| GHSA-jx2c-rxcm-jvmq Fastify's Content-Type header tab character allows body validation bypass |
High EPSS 0.86% |
< 5.7.2 | 5.7.2 |
| GHSA-247c-9743-5963 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header |
High EPSS 0.73% |
>= 5.0.0, < 5.3.2 | 5.3.2 |
| GHSA-247c-9743-5963 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header |
High EPSS 0.73% |
>= 4.29.0, < 4.29.1 | 4.29.1 |
| GHSA-247c-9743-5963 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header |
High EPSS 0.73% |
>= 5.3.2, < 5.8.5 | 5.8.5 |
| GHSA-3fjj-p79j-c9hh Fastify: Incorrect Content-Type parsing can lead to CSRF attack |
High EPSS 0.41% |
>= 4.0.0, < 4.10.2 | 4.10.2 |
| GHSA-3fjj-p79j-c9hh Fastify: Incorrect Content-Type parsing can lead to CSRF attack |
High EPSS 0.41% |
>= 3.0.0, < 3.29.4 | 3.29.4 |
| GHSA-455w-c45v-86rg fastify vulnerable to denial of service via malicious Content-Type |
High EPSS 59.24% |
>= 4.0.0, < 4.8.1 | 4.8.1 |
| GHSA-xw5p-hw6r-2j98 Denial of service in fastify |
Medium EPSS 1.16% |
< 2.15.1 | 2.15.1 |
| GHSA-mq6c-fh97-4gwv Denial of Service vulnerability with large JSON payloads in fastify |
High EPSS 1.77% |
< 0.38.0 | 0.38.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor