fastify kayıtları
fastify üreticisine ait 64 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %98,4
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-436 Interpretation Conflict7
- CWE-20 Improper Input Validation6
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5
- CWE-352 Cross-Site Request Forgery (CSRF)5
- CWE-400 Uncontrolled Resource Consumption4
- CWE-770 Allocation of Resources Without Limits or Throttling4
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
64 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
48Planlayın | CVE-2022-39288İstismar yok | Denial of service in Fastify via Content-Type headerfastify · fastify · CWE-754 | Yüksek7,5 | — | %59,2 | 10 Eki 2022 |
40Planlayın | CVE-2026-15631İstismar yok | @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversalfastify · fastify\/http-proxy · CWE-22 | Kritik10,0 | — | %0,5 | 18 Tem 2026 |
40Planlayın | CVE-2026-16117İstismar yok | @fastify/http-proxy vulnerable to prefix escape via URL-encoded charactersfastify · fastify\/http-proxy · CWE-20 | Kritik10,0 | — | %0,4 | 18 Tem 2026 |
40Planlayın | CVE-2026-16158İstismar yok | @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collisionfastify · fastify\/reply-from · CWE-441 | Kritik10,0 | — | %0,4 | 18 Tem 2026 |
36İzleyin | CVE-2026-6270İstismar yok | @fastify/middie vulnerable to middleware authentication bypass in child plugin scopesfastify · fastify\/middie · CWE-436 | Kritik9,1 | — | %0,6 | 16 Nis 2026 |
36İzleyin | CVE-2026-33805İstismar yok | @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersfastify · fastify\/http-proxy · CWE-644 | Kritik9,0 | — | %0,6 | 15 Nis 2026 |
36İzleyin | CVE-2026-33808İstismar yok | @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)fastify · fastify\/express · CWE-436 | Kritik9,1 | — | %0,6 | 15 Nis 2026 |
36İzleyin | CVE-2026-33807İstismar yok | @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopesfastify · fastify\/express · CWE-436 | Kritik9,1 | — | %0,5 | 15 Nis 2026 |
36İzleyin | CVE-2026-85184İstismar yok | @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request targetfastify · fastify\/middie · CWE-436 | Kritik9,1 | — | %0,5 | 4 Eyl 2026 |
36İzleyin | CVE-2026-6556İstismar yok | @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed pluginsfastify · fastify\/express · CWE-285 | Kritik9,1 | — | %0,5 | 30 Haz 2026 |
36İzleyin | CVE-2026-14198İstismar yok | @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesfastify · fastify\/middie · CWE-436 | Kritik9,1 | — | %0,5 | 1 Tem 2026 |
36İzleyin | CVE-2026-33804İstismar yok | @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionfastify · fastify\/middie · CWE-436 | Kritik9,1 | — | %0,5 | 16 Nis 2026 |
36İzleyin | CVE-2026-18248İstismar yok | @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event headerfastify · fastify\/aws-lambda · CWE-345 | Kritik9,1 | — | %0,4 | 3 Ağu 2026 |
35İzleyin | CVE-2021-22964İstismar yok | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox usefastify · fastify-static · CWE-400 | Yüksek8,8 | — | %1,0 | 14 Eki 2021 |
35İzleyin | CVE-2020-28482İstismar yok | Cross-site Request Forgery (CSRF)fastify · fastify-csrf · CWE-200 | Yüksek8,8 | — | %1,0 | 19 Oca 2021 |
35İzleyin | CVE-2023-31999İstismar yok | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.fastify · oauth2 · CWE-352 | Yüksek8,8 | — | %0,7 | 4 Tem 2023 |
35İzleyin | CVE-2026-22031İstismar yok | Fastify Middie Middleware Path Bypassfastify · fastify\/middie · CWE-177 | Yüksek8,8 | — | %0,5 | 19 Oca 2026 |
35İzleyin | CVE-2022-41919İstismar yok | Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content typefastify · fastify · CWE-352 | Yüksek8,8 | — | %0,4 | 22 Kas 2022 |
32İzleyin | CVE-2023-29019İstismar yok | Session fixation in fastify-passportfastify · passport · CWE-384 | Yüksek8,1 | — | %0,8 | 21 Nis 2023 |
32İzleyin | CVE-2026-2880İstismar yok | @fastify/middie has an improper path normalization vulnerabilityfastify · fastify\/middie · CWE-20 | Yüksek8,2 | — | %0,5 | 27 Şub 2026 |
32İzleyin | CVE-2026-84504İstismar yok | fastify vulnerable to request body replacement via an async validation result collisionfastify · fastify · CWE-20 | Yüksek8,1 | — | %0,4 | 4 Eyl 2026 |
32İzleyin | CVE-2026-18500İstismar yok | @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request keyfastify · fastify\/jwt · CWE-347 | Yüksek8,1 | — | %0,3 | 15 Ağu 2026 |
31İzleyin | CVE-2021-23597İstismar yok | Denial of Service (DoS)fastify · fastify-multipart · CWE-1321 | Yüksek7,5 | — | %2,0 | 11 Şub 2022 |
31İzleyin | CVE-2018-3711İstismar yok | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" andfastify · fastify · CWE-770 | Yüksek7,5 | — | %1,8 | 6 Haz 2018 |
30İzleyin | CVE-2020-8136İstismar yok | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests bfastify · fastify-multipart · CWE-400 | Yüksek7,5 | — | %1,5 | 20 Mar 2020 |
- CVE-2022-3928848Planlayın
Denial of service in Fastify via Content-Type header
YüksekCVSS 7,5İstismar yokEPSS %59fastify · fastify10 Eki 2022
- CVE-2026-1563140Planlayın
@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
KritikCVSS 10,0İstismar yokEPSS %1fastify · fastify\/http-proxy18 Tem 2026
- CVE-2026-1611740Planlayın
@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
KritikCVSS 10,0İstismar yokEPSS %0fastify · fastify\/http-proxy18 Tem 2026
- CVE-2026-1615840Planlayın
@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
KritikCVSS 10,0İstismar yokEPSS %0fastify · fastify\/reply-from18 Tem 2026
- CVE-2026-627036İzleyin
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/middie16 Nis 2026
- CVE-2026-3380536İzleyin
@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
KritikCVSS 9,0İstismar yokEPSS %1fastify · fastify\/http-proxy15 Nis 2026
- CVE-2026-3380836İzleyin
@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/express15 Nis 2026
- CVE-2026-3380736İzleyin
@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/express15 Nis 2026
- CVE-2026-8518436İzleyin
@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/middie4 Eyl 2026
- CVE-2026-655636İzleyin
@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/express30 Haz 2026
- CVE-2026-1419836İzleyin
@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
KritikCVSS 9,1İstismar yokEPSS %1fastify · fastify\/middie1 Tem 2026
- CVE-2026-3380436İzleyin
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
KritikCVSS 9,1İstismar yokEPSS %0fastify · fastify\/middie16 Nis 2026
- CVE-2026-1824836İzleyin
@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
KritikCVSS 9,1İstismar yokEPSS %0fastify · fastify\/aws-lambda3 Ağu 2026
- CVE-2021-2296435İzleyin
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox use
YüksekCVSS 8,8İstismar yokEPSS %1fastify · fastify-static14 Eki 2021
- CVE-2020-2848235İzleyin
Cross-site Request Forgery (CSRF)
YüksekCVSS 8,8İstismar yokEPSS %1fastify · fastify-csrf19 Oca 2021
- CVE-2023-3199935İzleyin
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.
YüksekCVSS 8,8İstismar yokEPSS %1fastify · oauth24 Tem 2023
- CVE-2026-2203135İzleyin
Fastify Middie Middleware Path Bypass
YüksekCVSS 8,8İstismar yokEPSS %1fastify · fastify\/middie19 Oca 2026
- CVE-2022-4191935İzleyin
Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type
YüksekCVSS 8,8İstismar yokEPSS %0fastify · fastify22 Kas 2022
- CVE-2023-2901932İzleyin
Session fixation in fastify-passport
YüksekCVSS 8,1İstismar yokEPSS %1fastify · passport21 Nis 2023
- CVE-2026-288032İzleyin
@fastify/middie has an improper path normalization vulnerability
YüksekCVSS 8,2İstismar yokEPSS %1fastify · fastify\/middie27 Şub 2026
- CVE-2026-8450432İzleyin
fastify vulnerable to request body replacement via an async validation result collision
YüksekCVSS 8,1İstismar yokEPSS %0fastify · fastify4 Eyl 2026
- CVE-2026-1850032İzleyin
@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
YüksekCVSS 8,1İstismar yokEPSS %0fastify · fastify\/jwt15 Ağu 2026
- CVE-2021-2359731İzleyin
Denial of Service (DoS)
YüksekCVSS 7,5İstismar yokEPSS %2fastify · fastify-multipart11 Şub 2022
- CVE-2018-371131İzleyin
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and
YüksekCVSS 7,5İstismar yokEPSS %2fastify · fastify6 Haz 2018
- CVE-2020-813630İzleyin
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests b
YüksekCVSS 7,5İstismar yokEPSS %1fastify · fastify-multipart20 Mar 2020