fastify

Records77All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

fastify records in CISA KEV

No fastify vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fastify 16 records HIGH Fastify-static 7 records MEDIUM Fastify/middie 7 records HIGH Fastify-multipart 5 records MEDIUM Fastify/http-proxy 4 records HIGH Fastify/busyboy 3 records MEDIUM Fastify/express 3 records HIGH Reply-from 3 records HIGH

Records

3 records in Fastify/express · all components

TI-2026-26180 CVE-2026-33808 · GHSA-6hw5-45gm-fj88

@fastify/express vulnerable to middleware authentication bypass via URL normalization…

HIGH 80

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00483 Published 2026-04-15 Fixed in 4.0.5 CWE-436

TI-2026-26179 CVE-2026-33807 · GHSA-hrwm-hgmj-7p9c

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

HIGH 80

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0043 Published 2026-04-15 Fixed in 4.0.5 CWE-436

TI-2026-05746 CVE-2026-6556

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

MEDIUM 48

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-06-30 Fixed in 4.0.7 CWE-285

Open these records in search →

Critical	16
High	37
Medium	22
Low	2
No CVSS	0