Skip to content

Update dependency fastify to v5 [SECURITY] - #397

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-fastify-vulnerability
Open

Update dependency fastify to v5 [SECURITY]#397
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-fastify-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
fastify (source) ^4.10.2 → ^5.0.0 age adoption passing confidence

Fastify's Content-Type header tab character allows body validation bypass

CVE-2026-25223 / GHSA-jx2c-rxcm-jvmq

More information

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})
Resources

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

CVE-2026-25224 / GHSA-mrq3-vjjr-p77c

More information

Details

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

CVE-2026-3635 / GHSA-444r-cwp2-x5xf

More information

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

CVE-2026-18504 / GHSA-w2qp-rph6-63g4

More information

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

fastify/fastify (fastify)

v5.12.1

Compare Source

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

v5.11.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

v5.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.5...v5.9.0

v5.8.5

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Compare Source

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.1...v5.8.2

v5.8.1

Compare Source

⚠️ Security Release

Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": GHSA-573f-x89g-hqp9.

CVE-2026-3419

Full Changelog: fastify/fastify@v5.8.0...v5.8.1

v5.8.0

Compare Source

What's Changed

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label May 9, 2026
@socket-security

socket-security Bot commented May 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedfastify@​4.26.2 ⏵ 5.12.598100 +2010099 +10100

View full report

@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 3fe9dce to 4f4c0e5 Compare May 18, 2026 10:02
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 4f4c0e5 to e85ea68 Compare May 28, 2026 14:44
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from e85ea68 to 5ed6422 Compare June 11, 2026 12:06
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 6cad2cb to 4539fa9 Compare July 16, 2026 17:07
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from ed47f48 to b4f0e8a Compare July 24, 2026 21:08
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from b4f0e8a to e5644f4 Compare July 30, 2026 17:09
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 0a79283 to f84d46b Compare August 14, 2026 19:41
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from f84d46b to 7ad88ba Compare August 26, 2026 12:05
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from fc56460 to e026161 Compare September 7, 2026 17:24
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from e026161 to 84b4580 Compare September 15, 2026 15:15
@renovate
renovate Bot force-pushed the renovate/npm-fastify-vulnerability branch from 84b4580 to b08f1e8 Compare September 16, 2026 12:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants