Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107318] @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. …

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path networ…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92087] @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies…

@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dr…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-75021] fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind…

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can ach…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

Vulnerabilidad en Fastify anterior a v5.12.2 por validación incompleta de encabezados HTTP

Fastify versiones anteriores a 5.12.2 presentan una validación incompleta de encabezados HTTP case-insensitive en esquemas de rutas. La transformación de minúsculas no se aplica correctamente en dependencias JSON Schema Draft 7, permitiendo que propiedades no normalizadas en el esquema causen comportamiento inesperado o bypass de validaciones. Esto afecta a aplicaciones Node.js en producción que dependen de validación estricta de encabezados para autenticación, autorización o filtrado de solicitudes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84469] fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthi…

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84504] fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the …

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that s…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-76169] fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix t…

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and s…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85124] @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash …

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escap…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-18500] @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verifi…

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accep…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-18549] @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19474] @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19484] @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthent…

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19481] @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who ca…

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18427] @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. …

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…

nvdaltovulnerabilidad CVSS 7.3 NVD

F Alto vulnerabilidad

23/07/2026

[CVE-2026-15074] @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request …

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-sc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16158] Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal UR…

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused …

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

18/07/2026

[CVE-2026-15631] Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the reso…

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite pr…

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

01/07/2026

[CVE-2026-14181] @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the st…

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js p…

nvdaltovulnerabilidad CVSS 7.5 NVD