PatchTheCVEfastify vulnerabilities and fixes
Recent CVEs affecting fastify, with upgrade or downgrade steps. 4 tracked.
fastify has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-09-04. Highest priority: CVE-2026-76169 (score 42/100).
- CVE-2026-76169 HIGH 7.5 UPGRADE fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the cust
- CVE-2026-84469 HIGH 7.5 UPGRADE fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but
- CVE-2026-84504 HIGH 8.1 UPGRADE fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value resu
- CVE-2026-84428 HIGH 7.5 UPGRADE fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names
FAQ
How do I fix fastify vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fastify being exploited right now?
None of the tracked fastify CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fastify CVE should I patch first?
CVE-2026-76169 currently ranks highest (42/100): fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the cust.