fastify

Records77All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

fastify records in CISA KEV

No fastify vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fastify 16 records HIGH Fastify-static 7 records MEDIUM Fastify/middie 7 records HIGH Fastify-multipart 5 records MEDIUM Fastify/http-proxy 4 records HIGH Fastify/busyboy 3 records MEDIUM Fastify/express 3 records HIGH Reply-from 3 records HIGH

Records

4 records in Fastify/http-proxy · all components

TI-2026-26177 CVE-2026-33805 · GHSA-gwhp-pf74-vj37

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

HIGH 78

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00441 Published 2026-04-15 Fixed in 12.6.2, 11.4.4 CWE-644

TI-2026-13487 CVE-2026-16117

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

MEDIUM 49

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00444 Published 2026-07-18 Fixed in 11.6.0 CWE-20

TI-2026-13153 CVE-2026-15631

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

MEDIUM 43

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00501 Published 2026-07-18 Fixed in 11.6.0 CWE-22

TI-2026-58468 CVE-2026-85124

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

MEDIUM 40

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00737 Published 2026-09-03 Partial fix · 11.6.2 CWE-22

Open these records in search →

Critical	16
High	37
Medium	22
Low	2
No CVSS	0