Logo

The OpenJS Foundation's CVE Numbering Authority (CNA)

Security Advisories

Published CVEs for security vulnerabilities in OpenJS hosted projects. Subscribe via RSS to get notified of new advisories.

Date CVE ID Advisory Project Title
2026-10-08 CVE-2026-107318 Advisory @fastify/reply-from @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
2026-10-08 CVE-2026-107275 Advisory @fastify/jwt @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
2026-09-17 CVE-2026-90982 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via path case-folding
2026-09-16 CVE-2026-92395 Advisory @fastify/proxy-addr @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
2026-09-16 CVE-2026-92087 Advisory @fastify/auth @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
2026-09-16 CVE-2026-92081 Advisory fastify fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
2026-09-15 CVE-2026-86818 Advisory fast-uri fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
2026-09-15 CVE-2026-86472 Advisory fast-uri fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
2026-09-15 CVE-2026-90711 Advisory proxy-addr proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
2026-09-15 CVE-2026-17495 Advisory moment moment vulnerable to Path Traversal via crafted non-string locale name
2026-09-14 CVE-2026-88932 Advisory multer multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
2026-09-11 CVE-2026-87776 Advisory compression compression vulnerable to Denial of Service via memory leak on premature response close
2026-09-11 CVE-2026-87123 Advisory hbs hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping
2026-09-11 CVE-2026-87859 Advisory morgan morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
2026-09-11 CVE-2026-87908 Advisory multiparty multiparty vulnerable to Denial of Service via unbounded part-header accumulation
2026-09-10 CVE-2026-88038 Advisory cookies cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
2026-09-08 CVE-2026-75021 Advisory fastify-cli fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
2026-09-04 CVE-2026-18149 Advisory undici undici vulnerable to Denial of Service via orphaned RetryHandler response body
2026-09-04 CVE-2026-18540 Advisory undici undici vulnerable to downstream response splitting via retry interceptor
2026-09-04 CVE-2026-19534 Advisory undici undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
2026-09-04 CVE-2026-84890 Advisory undici undici vulnerable to Denial of Service via unbounded decompression of compressed responses
2026-09-04 CVE-2026-84933 Advisory undici undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
2026-09-04 CVE-2026-84947 Advisory undici undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
2026-09-04 CVE-2026-84961 Advisory undici undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
2026-09-04 CVE-2026-85008 Advisory undici undici vulnerable to caching and replay of unsafe HTTP method responses
2026-09-04 CVE-2026-85152 Advisory undici undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
2026-09-04 CVE-2026-85014 Advisory undici undici vulnerable to Denial of Service via WebSocketStream unclean close
2026-09-04 CVE-2026-85024 Advisory undici undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
2026-09-04 CVE-2026-84428 Advisory fastify fastify vulnerable to header validation bypass via incomplete schema case normalization
2026-09-04 CVE-2026-84469 Advisory fastify fastify vulnerable to request validation bypass via skipped boolean false schemas
2026-09-04 CVE-2026-76169 Advisory fastify fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
2026-09-04 CVE-2026-84504 Advisory fastify fastify vulnerable to request body replacement via an async validation result collision
2026-09-04 CVE-2026-85184 Advisory @fastify/middie @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
2026-09-03 CVE-2026-85124 Advisory @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
2026-09-02 CVE-2026-84394 Advisory fast-uri fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
2026-09-02 CVE-2026-84292 Advisory fast-uri fast-uri vulnerable to authority injection via an unvalidated port in serialize
2026-08-28 CVE-2026-82333 Advisory multer multer vulnerable to Denial of Service via oversized array index in field names
2026-08-28 CVE-2026-77078 Advisory multer multer vulnerable to Denial of Service via crafted multipart field names
2026-08-28 CVE-2026-77063 Advisory multer multer vulnerable to file size limit bypass via async fileFilter race condition
2026-08-28 CVE-2026-77037 Advisory multer multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
2026-08-28 CVE-2026-15603 Advisory morgan morgan vulnerable to Log Forging via unescaped Unicode line separators
2026-08-25 CVE-2026-16231 Advisory hbs hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
2026-08-24 CVE-2026-76172 Advisory fast-uri fast-uri vulnerable to host confusion via percent-encoded scheme normalization
2026-08-24 CVE-2026-75975 Advisory fast-uri fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
2026-08-24 CVE-2026-75899 Advisory fast-uri fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
2026-08-24 CVE-2026-75931 Advisory fast-uri fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
2026-08-21 CVE-2026-74866 Advisory @fastify/busboy @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
2026-08-18 CVE-2026-16732 Advisory fastify fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
2026-08-18 CVE-2026-18504 Advisory fastify fastify vulnerable to schema validation bypass via root primitive coercion mismatch
2026-08-15 CVE-2026-18165 Advisory @fastify/oauth2 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies
2026-08-15 CVE-2026-19474 Advisory @fastify/multipart @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
2026-08-15 CVE-2026-18549 Advisory @fastify/multipart @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
2026-08-15 CVE-2026-18500 Advisory @fastify/jwt @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
2026-08-13 CVE-2026-19484 Advisory @fastify/busboy @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
2026-08-13 CVE-2026-19481 Advisory @fastify/busboy @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
2026-08-06 CVE-2026-18427 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via non-canonical path segments
2026-08-03 CVE-2026-18248 Advisory @fastify/aws-lambda @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
2026-07-31 CVE-2026-18446 Advisory fast-uri fast-uri vulnerable to host confusion via backslash authority introducer
2026-07-29 CVE-2026-15157 Advisory undici undici vulnerable to CRLF Injection via blob-like body 'type' property
2026-07-29 CVE-2026-14643 Advisory undici undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
2026-07-29 CVE-2026-16728 Advisory undici undici vulnerable to downstream response desynchronization via retry interceptor
2026-07-29 CVE-2026-16729 Advisory undici undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
2026-07-29 CVE-2026-13697 Advisory undici undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
2026-07-29 CVE-2026-15144 Advisory @fastify/rate-limit @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
2026-07-29 CVE-2026-18174 Advisory @fastify/forwarded @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For
2026-07-23 CVE-2026-15074 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via path traversal
2026-07-23 CVE-2026-7120 Advisory @fastify/static @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
2026-07-19 CVE-2026-16221 Advisory fast-uri fast-uri vulnerable to host confusion via literal backslash authority delimiter
2026-07-18 CVE-2026-16117 Advisory @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
2026-07-18 CVE-2026-15631 Advisory @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
2026-07-18 CVE-2026-16158 Advisory @fastify/reply-from @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
2026-07-09 CVE-2026-12590 Advisory body-parser body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
2026-07-03 CVE-2026-14631 Advisory webpack-dev-server webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
2026-07-03 CVE-2026-14620 Advisory webpack-dev-server webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
2026-07-01 CVE-2026-14181 Advisory @fastify/middie @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
2026-07-01 CVE-2026-14198 Advisory @fastify/middie @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
2026-06-30 CVE-2026-6556 Advisory @fastify/express @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
2026-06-29 CVE-2026-13676 Advisory fast-uri fast-uri vulnerable to host confusion via failed IDN canonicalization
2026-06-17 CVE-2026-11525 Advisory undici undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
2026-06-17 CVE-2026-6733 Advisory undici undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
2026-06-17 CVE-2026-9678 Advisory undici undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
2026-06-17 CVE-2026-9679 Advisory undici undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
2026-06-17 CVE-2026-9697 Advisory undici undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
2026-06-17 CVE-2026-6734 Advisory undici undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
2026-06-17 CVE-2026-9675 Advisory undici undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
2026-06-17 CVE-2026-12151 Advisory undici undici WebSocket client vulnerable to denial of service via fragment count bypass
2026-06-15 CVE-2026-9595 Advisory webpack-dev-server webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
2026-06-15 CVE-2026-5038 Advisory multer multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
2026-06-15 CVE-2026-5079 Advisory multer multer vulnerable to Denial of Service via deeply nested field names
2026-06-04 CVE-2026-10796 Advisory nvm nvm vulnerable to OS command injection via crafted version strings from a malicious Node.js mirror
2026-06-03 CVE-2026-5078 Advisory morgan morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
2026-05-12 CVE-2026-8162 Advisory multiparty multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
2026-05-12 CVE-2026-8161 Advisory multiparty multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
2026-05-12 CVE-2026-8159 Advisory multiparty multiparty vulnerable to ReDoS via filename parsing
2026-05-12 CVE-2026-6402 Advisory webpack-dev-server webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
2026-05-05 CVE-2026-6322 Advisory fast-uri fast-uri vulnerable to host confusion via percent-encoded authority delimiters
2026-05-04 CVE-2026-6321 Advisory fast-uri fast-uri vulnerable to path traversal via percent-encoded dot segments
2026-05-04 CVE-2026-7768 Advisory @fastify/accepts-serializer @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
2026-04-16 CVE-2026-33804 Advisory @fastify/middie @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
2026-04-16 CVE-2026-6270 Advisory @fastify/middie @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
2026-04-16 CVE-2026-6410 Advisory @fastify/static @fastify/static vulnerable to path traversal in directory listing
2026-04-16 CVE-2026-6414 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via encoded path separators
2026-04-15 CVE-2026-33805 Advisory @fastify/reply-from @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
2026-04-15 CVE-2026-33805 Advisory @fastify/http-proxy @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
2026-04-15 CVE-2026-33807 Advisory @fastify/express @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
2026-04-15 CVE-2026-33808 Advisory @fastify/express @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
2026-04-14 CVE-2026-33806 Advisory fastify fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
2026-03-31 CVE-2026-4800 Advisory lodash Incomplete fix for CVE-2021-23337 allows code injection via _.template imports key names
2026-03-31 CVE-2026-2950 Advisory lodash lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit
2026-03-26 CVE-2026-4926 Advisory path-to-regexp path-to-regexp vulnerable to Denial of Service via sequential optional groups
2026-03-26 CVE-2026-4923 Advisory path-to-regexp ReDoS possible with multiple wildcards
2026-03-26 CVE-2026-4867 Advisory path-to-regexp path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
2026-03-23 CVE-2026-3635 Advisory fastify Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function
2026-03-12 CVE-2026-2581 Advisory undici Unbounded Memory Consumption in Undici's DeduplicationHandler via Response Buffering leads to DoS
2026-03-12 CVE-2026-1527 Advisory undici CRLF Injection in undici via upgrade option
2026-03-12 CVE-2026-1528 Advisory undici Malicious WebSocket 64-bit length overflows undici parser and crashes the client
2026-03-12 CVE-2026-2229 Advisory undici Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
2026-03-12 CVE-2026-1526 Advisory undici Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
2026-03-12 CVE-2026-1525 Advisory undici Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) in undici
2026-03-05 CVE-2026-3419 Advisory fastify Fastify vulnerable to missing end anchor in subtypeNameReg Allows Malformed Content-Types to Pass Validation
2026-03-04 CVE-2026-3520 Advisory multer Multer vulnerable to Denial of Service via uncontrolled recursion
2026-02-27 CVE-2026-2880 Advisory @fastify/middie @fastify/middie has an improper path normalization vulnerability
2026-02-27 CVE-2026-3304 Advisory multer Multer vulnerable to Denial of Service via incomplete cleanup
2026-02-27 CVE-2026-2359 Advisory multer multer vulnerable to Denial of Service via resource exhaustion
2026-01-21 CVE-2025-13465 Advisory lodash Prototype Pollution Vulnerability in Lodash `_.unset` and `_.omit` functions
2025-11-24 CVE-2025-13466 Advisory body-parser body-parser vulnerable to denial of service when url encoding is used
2025-07-17 CVE-2025-7339 Advisory on-headers on-headers vulnerable to http response header manipulation
2025-07-17 CVE-2025-7338 Advisory multer Multer vulnerable to Denial of Service via unhandled exception from malformed request