Authentication Bypass Using an Alternate Path or Channelfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and bypass its preHandler by sending a malformed request target such as /public/%c0 to a sibling plugin prefix when no route matches the request method. Because the malformed URL is routed through the shared not-found dispatch path, Fastify can invoke the wrong plugin’s 404 handler and return its response without running the protected handler’s authentication hook. This breaks prefix-scoped not-found handling and exposes any data or behavior that the private fallback handler would normally guard.
Workarounds
- Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, to prevent malformed URLs from reaching encapsulated not-found handlers and bypassing their
preHandler authentication hooks.
- Do not rely on a not-found handler to serve protected data, so a malformed URL cannot be used to obtain private fallback responses from a sibling plugin’s 404 handler.
How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade fastify to version 5.12.2 or higher.
| |
Improper Validation of Unsafe Equivalence in Inputfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced header dependencies by sending canonical-cased header names in a request while omitting the dependent header the schema is meant to require. Because Node.js stores request headers in lowercase, Fastify’s shallow normalization missed dependencies and nested subschemas, so assertions such as requiring X-Admin-Token when X-Admin is present never matched the incoming request headers. This lets a remote client reach privileged header-gated routes or actions without supplying the full set of headers the application intended to enforce.
Workarounds
- Inline the header schema instead of referencing it with an external
$ref, so header names can be case-normalized and case-insensitive assertions like required and dependencies still apply.
How to fix Improper Validation of Unsafe Equivalence in Input? Upgrade fastify to version 5.12.2 or higher.
| |
Improper Validation of Specified Type of Inputfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the route schema handling in lib/route.js, lib/schemas.js, and lib/validation.js. An attacker can reach a route handler with arbitrary input by sending a request to an endpoint that uses false as a deny-all schema for body, querystring, params, headers, or the query alias. Because those schemas were treated as absent when evaluated for JavaScript truthiness, Fastify skipped validator compilation and let the request proceed to the handler, allowing unauthenticated access to routes that were intended to reject every request.
Workarounds
- Express a deny-all request schema with an always-failing object schema such as
{ "not": {} } instead of the boolean false, so the route still rejects requests before they reach the handler.
- Reject the request in an
onRequest hook, so unauthenticated clients are blocked before route handling even if a request-part schema was defined with false.
How to fix Improper Validation of Specified Type of Input? Upgrade fastify to version 5.12.2 or higher.
| |
Incorrect Behavior Order: Early Validationfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation through the request validation path in lib/validation.js. An attacker can replace the validated request body, or trigger a validation failure, by sending an $async schema-validated payload that includes attacker-controlled value or error properties. When a route uses an asynchronous request schema, Fastify processes the resolved validator result before the handler runs and can pass the handler a different body than the one that satisfied the schema. This can lead to unauthorized state changes or data disclosure in applications that trust the validated request body for business logic.
Workarounds
- Avoid
$async request schemas.
- Perform the security-sensitive check in an
onRequest or preHandler hook rather than relying on the schema-validated request part.
- Custom async validator compilers should throw or reject on failure instead of returning an
{ error } object.
How to fix Incorrect Behavior Order: Early Validation? Upgrade fastify to version 5.12.2 or higher.
| |
Improper Validation of Specified Type of Inputfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the request validation path in lib/validation.js. An attacker can bypass body schema type enforcement by sending a root-level primitive JSON body such as "10" to a route that expects an integer. Fastify validates the coerced primitive value but leaves request.body as the original uncoerced string when the handler runs. Applications that trust the validated type can then apply business rules to the wrong type, breaking input limits and other request-body checks.
Workarounds
- Wrap the value in an object schema instead of using a root primitive body, for example accept
{ "value": 10 } and read request.body.value; this keeps coercion in-place and prevents the handler from seeing an uncoerced root string.
- Re-check the type in the route handler before applying business rules; this prevents trust in a root primitive body value that may not match the validated type.
How to fix Improper Validation of Specified Type of Input? Upgrade fastify to version 5.12.1 or higher.
| |
Improper Validation of Specified Type of Inputfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the schema.body.content when a space is prepended to the Content-Type header. An attacker can bypass input validation by sending requests with a leading space in the Content-Type header, causing the body to be parsed but skipping schema validation.
Note:
Even though the vulnerability was fixed in version 5.3.2, that version introduced a regression, and a new vulnerability was caused by the fix (CVE-2026-33806).
To be fully protected from both the original issue, recommand to upgrade to v5.8.5.
How to fix Improper Validation of Specified Type of Input? Upgrade fastify to version 5.8.5 or higher.
| |
Use of Less Trusted Sourcefastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Use of Less Trusted Source in the request.protocol and request.host getters. An attacker can manipulate the perceived protocol and host by sending crafted X-Forwarded-Proto and X-Forwarded-Host headers after bypassing the proxy and connecting directly to the application port, potentially impacting security decisions such as HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, or host-based routing.
Note: This is only exploitable if the application uses the trustProxy option with a restrictive trust function and relies on request.protocol or request.host for security decisions, and the attacker is able to connect directly to the application, bypassing the proxy.
How to fix Use of Less Trusted Source? Upgrade fastify to version 5.8.3 or higher.
| |
Interpretation Conflictfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Interpretation Conflict via the Content-Type header processing. An attacker can bypass body validation by appending a tab character (\t) and arbitrary content to the Content-Type header, causing the server to treat the body as the intended type without enforcing validation rules.
Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints.
How to fix Interpretation Conflict? Upgrade fastify to version 5.7.2 or higher.
| |
Allocation of Resources Without Limits or Throttlingfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the sendWebStream function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes.
Note: Only applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted
How to fix Allocation of Resources Without Limits or Throttling? Upgrade fastify to version 5.7.3 or higher.
| |
Improper Validation of Specified Type of Inputfastify is an overhead web framework, for Node.js.
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the validate() function, which does not sufficiently validate the content of messages with content-type-specifying headers. An attacker can bypass validation by providing a malformed content-type, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the content element of the structure below.
fastify.post('/', {
handler(request, reply) {
reply.code(200).send(request.body)
},
schema: {
body: {
content: {
'application/json': {
schema: {
type: 'object',
properties: {
'foo': {
type: 'string',
}
},
required: ['foo']
}
},
}
}
}
})
How to fix Improper Validation of Specified Type of Input? Upgrade fastify to version 4.29.1, 5.3.2 or higher.
| >=4.9.0 <4.29.1>=5.0.0 <5.3.2 |
