PatchTheCVEfastify vulnerabilities
Recent CVEs affecting fastify products. 23 tracked.
fastify has 23 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 22. Most recent: 2026-09-04. Highest priority: CVE-2026-33808 (score 52/100).
- CVE-2026-33808 CRITICAL 9.1 UPGRADE Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware wh
- CVE-2026-33805 HIGH 8.6 UPGRADE UPGRADE @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Conne
- CVE-2026-33807 CRITICAL 9.1 UPGRADE @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middle
- CVE-2026-74866 MEDIUM 5.8 UPGRADE @fastify/busboy is a multipart form-data parser for Node.js
- CVE-2026-76169 HIGH 7.5 UPGRADE fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the cust
- CVE-2026-84469 HIGH 7.5 UPGRADE fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but
- CVE-2026-84504 HIGH 8.1 UPGRADE fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value resu
- CVE-2026-85184 CRITICAL 9.1 UPGRADE @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching ag
- CVE-2026-84428 HIGH 7.5 UPGRADE fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names
- CVE-2026-85124 HIGH 7.5 UPGRADE @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-
- CVE-2026-18427 HIGH 7.5 UPGRADE @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass
- CVE-2026-18248 CRITICAL 9.1 DOWNGRADE @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsL
- CVE-2026-18500 HIGH 8.1 UPGRADE @fastify/jwt is a JSON Web Token plugin for Fastify
- CVE-2026-18165 MEDIUM 4.2 UPGRADE @fastify/oauth2 is an OAuth 2.0 plugin for Fastify
- CVE-2026-19481 HIGH 7.5 UPGRADE @fastify/busboy is a multipart form-data parser
- CVE-2026-19484 HIGH 7.5 UPGRADE @fastify/busboy is a multipart form-data parser
- CVE-2026-18549 HIGH 7.5 UPGRADE @fastify/multipart is a multipart form-data parser for Fastify
- CVE-2026-19474 HIGH 7.5 UPGRADE @fastify/multipart is a multipart form-data parser for Fastify
- CVE-2026-16158 HIGH 8.7 UPGRADE Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache ke
- CVE-2026-7120 MEDIUM 5.3 UPGRADE @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separato
- CVE-2026-15074 HIGH 7.5 UPGRADE @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames
- CVE-2026-15631 HIGH 8.7 UPGRADE Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSo
- CVE-2026-16117 CRITICAL 10.0 UPGRADE Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the pr
FAQ
How do I fix fastify vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fastify being exploited right now?
None of the tracked fastify CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fastify CVE should I patch first?
CVE-2026-33808 currently ranks highest (52/100): Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware wh.