UlisesGascon

multer vulnerable to file size limit bypass via async fileFilter race condition

multer vulnerable to Denial of Service via crafted multipart field names

multer vulnerable to Denial of Service via oversized array index in field names

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri vulnerable to host confusion via backslash authority introducer

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch