HackerOne

Denial of service in Fastify via Content-Type header

Prefix escape

Prefix escape

Denial of Service (DoS)

@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

also in 1 other product

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

also in 1 other product

HackerOne fastify node module: Allocation of Resources Without Limits or Throttling

also in 1 other product

Default swagger-ui configuration exposes all files in the module

also in 1 other product

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

also in 1 other product

@fastify/multipart vulnerable to DoS due to unlimited number of parts

Potential Timing Attack Vector in @fastify/bearer-auth

Fastify-multipart: Uncontrolled Resource Consumption

@fastify/static vulnerable to route guard bypass via non-canonical path segments

also in 1 other product

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

also in 1 other product

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

also in 1 other product

@fastify/static vulnerable to route guard bypass via path traversal

also in 1 other product

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

also in 1 other product

@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

Fastify: Authentication Bypass Using an Alternate Path or Channel

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

also in 1 other product

Fastify's Content-Type header tab character allows body validation bypass

fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify vulnerable to request body replacement via an async validation result collision