TI-2022-18664 CVE-2022-39288 · GHSA-455w-c45v-86rg
Denial of service in Fastify via Content-Type header
Priority HIGH 73
fastify is a fast and low overhead web framework, for Node.js.
fastify
Records77All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high37CVSS 7.0–8.9
Exploited now
fastify records in CISA KEVNo fastify vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records in Fastify · all components
TI-2025-23513 CVE-2025-32442 · GHSA-mg2h-6x62-wpwc
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
Priority MEDIUM 40
Fastify is a fast and low overhead web framework, for Node.js.
TI-2026-58050 CVE-2026-84469 · GHSA-hwr6-493r-vm6h
fastify vulnerable to request validation bypass via skipped boolean false schemas
Priority LOW 39
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance.
TI-2026-58022 CVE-2026-84428 · GHSA-9q9j-q6p8-xq58
fastify vulnerable to header validation bypass via incomplete schema case normalization
Priority LOW 39
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the prope…
TI-2026-53284 CVE-2026-76169 · GHSA-p68q-wchp-6fh7
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Priority LOW 39
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for tha…
TI-2026-26178 CVE-2026-33806 · GHSA-247c-9743-5963
fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Priority LOW 39
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header.
TI-2026-58072 CVE-2026-84504 · GHSA-667r-xxjv-c9mm
fastify vulnerable to request body replacement via an async validation result collision
Priority LOW 38
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers.
TI-2022-20260 CVE-2022-41919 · GHSA-3fjj-p79j-c9hh
Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type
Priority LOW 38
Fastify is a web framework with minimal overhead and plugin architecture.
TI-2018-02709 CVE-2018-3711 · GHSA-mq6c-fh97-4gwv
Resource allocation without limits in HackerOne fastify node module
Priority LOW 36
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.
TI-2026-20373 CVE-2026-25223 · GHSA-jx2c-rxcm-jvmq
Fastify's Content-Type header tab character allows body validation bypass
Priority LOW 34
Fastify is a fast and low overhead web framework, for Node.js.
TI-2020-06610 CVE-2020-8192 · GHSA-xw5p-hw6r-2j98
Uncontrolled resource consumption in fastify
Priority LOW 31
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
TI-2026-02952 CVE-2026-3419 · GHSA-573f-x89g-hqp9
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Priority LOW 30
Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type).
TI-2026-13934 CVE-2026-16732 · GHSA-3m5p-2c4r-xxw2
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Priority LOW 26
fastify is a fast and low overhead web framework for Node.js.
TI-2026-03135 CVE-2026-3635 · GHSA-444r-cwp2-x5xf
Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from…
Priority LOW 26
Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X…
TI-2026-15193 CVE-2026-18504 · GHSA-w2qp-rph6-63g4
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Priority LOW 24
fastify is a fast and low overhead web framework for Node.js.
TI-2026-20374 CVE-2026-25224 · GHSA-mrq3-vjjr-p77c
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
Priority LOW 18
Fastify is a fast and low overhead web framework, for Node.js.