mcollina

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/static vulnerable to route guard bypass via path case-folding

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

fastify vulnerable to request validation bypass via skipped boolean false schemas