Search for packages
| purl | pkg:npm/fastify@5.7.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-13ut-fezt-uuh1
Aliases: CVE-2026-33806 GHSA-247c-9743-5963 |
fastify: Fastify: Schema validation bypass via malformed Content-Type header |
Affected by 0 other vulnerabilities. |
|
VCID-ma3h-te21-ekhk
Aliases: CVE-2026-3635 GHSA-444r-cwp2-x5xf |
fastify: request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function |
Affected by 1 other vulnerability. |
|
VCID-sg2c-d386-d7dk
Aliases: CVE-2026-3419 GHSA-573f-x89g-hqp9 |
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of [RFC 9110 §8.3.1](https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with `Content-Type: application/json garbage` passes validation and is processed normally, rather than being rejected with `415 Unsupported Media Type`. When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-zxan-bkya-9kau | Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream A Denial of Service vulnerability in Fastify's Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a `ReadableStream` (or `Response` with a Web Stream body) via `reply.send()` are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. |
CVE-2026-25224
GHSA-mrq3-vjjr-p77c |