https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84428.htmlhttps://patchthecve.com/cve/CVE-2026-84428.htmlTue, 15 Sep 2026 19:54:32 +0000HIGH 7.5: fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the triggerhttps://patchthecve.com/cve/CVE-2026-85184.htmlhttps://patchthecve.com/cve/CVE-2026-85184.htmlTue, 15 Sep 2026 20:02:28 +0000CRITICAL 9.1: @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request uhttps://patchthecve.com/cve/CVE-2026-84504.htmlhttps://patchthecve.com/cve/CVE-2026-84504.htmlTue, 15 Sep 2026 20:05:15 +0000HIGH 8.1: fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that prophttps://patchthecve.com/cve/CVE-2026-84469.htmlhttps://patchthecve.com/cve/CVE-2026-84469.htmlTue, 15 Sep 2026 20:06:50 +0000HIGH 7.5: fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to dehttps://patchthecve.com/cve/CVE-2026-76169.htmlhttps://patchthecve.com/cve/CVE-2026-76169.htmlTue, 15 Sep 2026 20:07:46 +0000HIGH 7.5: fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches mahttps://patchthecve.com/cve/CVE-2026-85124.htmlhttps://patchthecve.com/cve/CVE-2026-85124.htmlWed, 09 Sep 2026 19:25:40 +0000HIGH 7.5: @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from lihttps://patchthecve.com/cve/CVE-2026-74866.htmlhttps://patchthecve.com/cve/CVE-2026-74866.htmlFri, 16 Oct 2026 15:10:00 +0000MEDIUM 5.8: @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the https://patchthecve.com/cve/CVE-2026-19474.htmlhttps://patchthecve.com/cve/CVE-2026-19474.htmlWed, 02 Sep 2026 15:12:02 +0000HIGH 7.5: @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that ohttps://patchthecve.com/cve/CVE-2026-18549.htmlhttps://patchthecve.com/cve/CVE-2026-18549.htmlWed, 02 Sep 2026 15:13:16 +0000HIGH 7.5: @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the https://patchthecve.com/cve/CVE-2026-18500.htmlhttps://patchthecve.com/cve/CVE-2026-18500.htmlFri, 04 Sep 2026 13:17:20 +0000HIGH 8.1: @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use differenthttps://patchthecve.com/cve/CVE-2026-18165.htmlhttps://patchthecve.com/cve/CVE-2026-18165.htmlFri, 04 Sep 2026 13:16:43 +0000MEDIUM 4.2: @fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the brohttps://patchthecve.com/cve/CVE-2026-19484.htmlhttps://patchthecve.com/cve/CVE-2026-19484.htmlThu, 03 Sep 2026 19:10:52 +0000HIGH 7.5: @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entryhttps://patchthecve.com/cve/CVE-2026-19481.htmlhttps://patchthecve.com/cve/CVE-2026-19481.htmlThu, 03 Sep 2026 19:16:01 +0000HIGH 7.5: @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in ahttps://patchthecve.com/cve/CVE-2026-18427.htmlhttps://patchthecve.com/cve/CVE-2026-18427.htmlFri, 04 Sep 2026 18:16:20 +0000HIGH 7.5: @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating thttps://patchthecve.com/cve/CVE-2026-18248.htmlhttps://patchthecve.com/cve/CVE-2026-18248.htmlFri, 04 Sep 2026 13:44:16 +0000CRITICAL 9.1: @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populathttps://patchthecve.com/cve/CVE-2026-7120.htmlhttps://patchthecve.com/cve/CVE-2026-7120.htmlTue, 28 Jul 2026 17:05:24 +0000MEDIUM 5.3: @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-cahttps://patchthecve.com/cve/CVE-2026-15074.htmlhttps://patchthecve.com/cve/CVE-2026-15074.htmlTue, 28 Jul 2026 17:02:14 +0000HIGH 7.5: @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segmenhttps://patchthecve.com/cve/CVE-2026-16117.htmlhttps://patchthecve.com/cve/CVE-2026-16117.htmlTue, 28 Jul 2026 15:39:01 +0000CRITICAL 10.0: Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replahttps://patchthecve.com/cve/CVE-2026-16158.htmlhttps://patchthecve.com/cve/CVE-2026-16158.htmlWed, 05 Aug 2026 19:46:33 +0000HIGH 8.7: Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. https://patchthecve.com/cve/CVE-2026-15631.htmlhttps://patchthecve.com/cve/CVE-2026-15631.htmlTue, 28 Jul 2026 15:42:54 +0000HIGH 8.7: Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapsehttps://patchthecve.com/cve/CVE-2026-14198.htmlhttps://patchthecve.com/cve/CVE-2026-14198.htmlThu, 02 Jul 2026 13:50:22 +0000CRITICAL 9.1: @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to mathttps://patchthecve.com/cve/CVE-2026-14181.htmlhttps://patchthecve.com/cve/CVE-2026-14181.htmlThu, 02 Jul 2026 13:50:58 +0000HIGH 7.5: @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to thttps://patchthecve.com/cve/CVE-2026-6556.htmlhttps://patchthecve.com/cve/CVE-2026-6556.htmlWed, 01 Jul 2026 15:57:54 +0000CRITICAL 9.1: @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doeshttps://patchthecve.com/cve/CVE-2026-33805.htmlhttps://patchthecve.com/cve/CVE-2026-33805.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.6: @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in thttps://patchthecve.com/cve/CVE-2026-33808.htmlhttps://patchthecve.com/cve/CVE-2026-33808.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.1: Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or viahttps://patchthecve.com/cve/CVE-2026-33807.htmlhttps://patchthecve.com/cve/CVE-2026-33807.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.1: @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causi