Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/08/2026

[CVE-2026-18500] @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verifi…

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accep…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-18549] @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19474] @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19484] @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthent…

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19481] @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who ca…

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18427] @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. …

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-18248] @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and re…

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP head…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…

nvdaltovulnerabilidad CVSS 7.3 NVD

F Alto vulnerabilidad

23/07/2026

[CVE-2026-15074] @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request …

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-sc…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

18/07/2026

[CVE-2026-16117] Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix w…

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16158] Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal UR…

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused …

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

18/07/2026

[CVE-2026-15631] Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the reso…

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite pr…

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

01/07/2026

[CVE-2026-14181] @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the st…

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js p…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

01/07/2026

[CVE-2026-14198] @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter valu…

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorizatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

15/06/2026

[CVE-2026-48714] i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti…

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-k…

nvdcriticovulnerabilidad CVSS 9.1 NVD