fastify

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled.

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins.

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders.

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances.

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.

fastify is a fast and low overhead web framework, for Node.js.

The @fastify/express plugin adds full Express compatibility to Fastify.

@fastify/middie is the plugin that adds middleware support on steroids to Fastify.

@fastify/multipart is a Fastify plugin for parsing the multipart content-type.

@fastify/session is a session plugin for fastify.

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded.

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix.

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path be…

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup.

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string.

@fastify/middie is the Express-style middleware engine for Fastify.

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API…

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks.

fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server.

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter.

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix.

@fastify/multipart is a Fastify plugin to parse the multipart content-type.

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers.

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled.

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream.