npm - OSV

GHSA-gxm5-99cw-xjw9

npm/@fastify/busboy

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name 05 Oct

Fix available
Severity - 5.8 (Medium)

GHSA-x8mw-p69m-v3mx

npm/@fastify/busboy

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header 02 Oct

Fix available
Severity - 7.5 (High)

GHSA-xjh9-v7x6-24jw

npm/@fastify/busboy

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary 02 Oct

Fix available
Severity - 7.5 (High)

GHSA-4mh8-r7rc-xpvc

npm/fastify

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses 30 Sep

Fix available
Severity - 5.9 (Medium)

GHSA-667r-xxjv-c9mm

npm/fastify

fastify vulnerable to request body replacement via an async validation result collision 30 Sep

Fix available
Severity - 8.1 (High)

GHSA-p68q-wchp-6fh7

npm/fastify

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-hwr6-493r-vm6h

npm/fastify

fastify vulnerable to request validation bypass via skipped boolean false schemas 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-9q9j-q6p8-xq58

npm/fastify

fastify vulnerable to header validation bypass via incomplete schema case normalization 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-9c5c-9qcx-q35q

npm/@nestjs/platform-fastify

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets 30 Sep

Fix available
Severity - 7.4 (High)

GHSA-3m5p-2c4r-xxw2

npm/fastify

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count 02 Sep

Fix available
Severity - 6.1 (Medium)

GHSA-w2qp-rph6-63g4

npm/fastify

fastify vulnerable to schema validation bypass via root primitive coercion mismatch 02 Sep

Fix available
Severity - 5.4 (Medium)

MAL-2026-12379

npm/fastify-client-bundler

Malicious code in fastify-client-bundler (npm) 05 Aug

No fix available

GHSA-8pvw-jcv7-9cmj

npm/@fastify/static

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths 24 Jul

Fix available
Severity - 5.3 (Medium)

GHSA-83w8-p2f5-377r

npm/@fastify/static

@fastify/static vulnerable to route guard bypass via path traversal 24 Jul

Fix available
Severity - 7.5 (High)

MAL-2026-10520

npm/fastify-bundler

Malicious code in fastify-bundler (npm) 14 Jul

No fix available

MAL-2026-10098

npm/fastify-addone

Malicious code in fastify-addone (npm) 09 Jul

No fix available

Vulnerabilities