mcollina

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static vulnerable to route guard bypass via path traversal

@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

fast-uri vulnerable to host confusion via literal backslash authority delimiter

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header