fastify 5.3.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the fastify package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Interpretation Conflict fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Interpretation Conflict via the `Content-Type` header processing. An attacker can bypass body validation by appending a tab character (`\t`) and arbitrary content to the `Content-Type` header, causing the server to treat the body as the intended type without enforcing validation rules. Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. How to fix Interpretation Conflict? Upgrade `fastify` to version 5.7.2 or higher.	<5.7.2
M Allocation of Resources Without Limits or Throttling fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `sendWebStream` function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes. Note: Only applications that return a `ReadableStream` (or `Response` with a `Web Stream` body) via `reply.send()` are impacted How to fix Allocation of Resources Without Limits or Throttling? Upgrade `fastify` to version 5.7.3 or higher.	<5.7.3
H Improper Validation of Specified Type of Input fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the `validate()` function, which does not sufficiently validate the content of messages with `content-type`-specifying headers. An attacker can bypass validation by providing a malformed `content-type`, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the `content` element of the structure below. `fastify.post('/', { handler(request, reply) { reply.code(200).send(request.body) }, schema: { body: { content: { 'application/json': { schema: { type: 'object', properties: { 'foo': { type: 'string', } }, required: ['foo'] } }, } } } })` How to fix Improper Validation of Specified Type of Input? Upgrade `fastify` to version 4.29.1, 5.3.2 or higher.	>=4.9.0 <4.29.1>=5.0.0 <5.3.2

Vulnerability

Vulnerable Version

Interpretation Conflict

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict via the Content-Type header processing. An attacker can bypass body validation by appending a tab character (\t) and arbitrary content to the Content-Type header, causing the server to treat the body as the intended type without enforcing validation rules.

Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints.

How to fix Interpretation Conflict?

Upgrade fastify to version 5.7.2 or higher.

<5.7.2

Allocation of Resources Without Limits or Throttling

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the sendWebStream function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes.

Note: Only applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade fastify to version 5.7.3 or higher.

<5.7.3

Improper Validation of Specified Type of Input

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the validate() function, which does not sufficiently validate the content of messages with content-type-specifying headers. An attacker can bypass validation by providing a malformed content-type, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the content element of the structure below.

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

How to fix Improper Validation of Specified Type of Input?

Upgrade fastify to version 4.29.1, 5.3.2 or higher.

>=4.9.0 <4.29.1>=5.0.0 <5.3.2

fastify@5.3.1 vulnerabilities

Fast and low overhead web framework, for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically