Fastify CVE-2025-66415

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect

Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso

A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit

Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent

Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected

Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza

Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi

Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth