Live data from GitHub and npm, updated daily.
Data last fetched: 2026-10-22
10 active CVEs reported via OSV.dev
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
Fastify: Incorrect Content-Type parsing can lead to CSRF attack
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
fastify vulnerable to denial of service via malicious Content-Type
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
fastify vulnerable to request body replacement via an async validation result collision
fastify vulnerable to header validation bypass via incomplete schema case normalization
fastify vulnerable to request validation bypass via skipped boolean false schemas
Get SLA-backed support, security patches, and direct access to senior engineers for Fastify — without relying on volunteer maintainers.