These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-107832 debrief: fastify vulnerable to header validation bypass via case-sensitive propertyNames. The fastify web framework for Node.js is vulnerable to a header validation bypass via case-sensitive propertyNames in versions 5.12.2 through 5.12.5. This vulnerability allows an attacker to bypass case-sensitive header validation rules, potentially leading to security issues. Defenders should priorit [truncated]
CVE-2026-84428 is a vulnerability in fastify versions before 5.12.2 that allows an unauthenticated remote client to bypass conditional checks by sending a header that activates a privileged branch while omitting the required header. This occurs due to the incomplete transformation of HTTP header names to lowercase, leading to a mismatch in canonical-case dependencies. The vulnerability can result in unaut [truncated]
CVE-2026-84504 is a high-severity vulnerability in fastify versions before 5.12.2. An authenticated low-privilege caller can exploit this vulnerability to make unauthorized state changes and disclose data. The vulnerability arises from fastify's treatment of the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its [truncated]
CVE-2026-84469 is a high-severity vulnerability in fastify versions before 5.12.2. An unauthenticated remote client can bypass validation and reach a handler that was intended to be unreachable, potentially leading to unauthorized state changes or execution of disabled operations. This vulnerability is caused by fastify's handling of JavaScript truthiness when compiling request schemas. According to JSON [truncated]
CVE-2026-76169 is a vulnerability in Fastify, a popular Node.js web framework, that allows an unauthenticated attacker to bypass authentication and read the full response of a private fallback handler through an unrelated public prefix. The vulnerability affects Fastify versions 4.0.0 and before 5.12.2. Users should upgrade to Fastify 5.12.2 or later to mitigate this vulnerability.
CVE-2026-15631 is a high-severity vulnerability in @fastify/http-proxy versions from 9.4.0 to 11.5.0. The issue allows path traversal attacks via WebSocket upgrade requests, potentially exposing upstream endpoints not meant to be accessed through the proxy. This vulnerability arises from the failure to validate the resolved WebSocket destination path against the configured rewrite prefix. Exploitation req [truncated]
A critical authentication bypass vulnerability exists in @fastify/express versions 4.0.4 and earlier. When Fastify router normalization options—specifically `ignoreDuplicateSlashes` or `useSemicolonDelimiter`—are enabled, the Fastify router normalizes incoming URLs to match protected routes, but @fastify/express passes the original un-normalized URL to Express middleware. This causes path-scoped authentic [truncated]
A critical path-handling vulnerability in @fastify/express versions 4.0.4 and earlier allows complete bypass of Express middleware security controls in child plugin scopes. The flaw resides in the `onRegister` function, which incorrectly doubles middleware paths when they are inherited by child plugins. When a child plugin is registered with a prefix that matches an existing middleware path, the middlewar [truncated]
CVE-2026-33806 is a high-severity vulnerability affecting Fastify applications that utilize schema.body.content for per-content-type body validation. The issue arises from a regression introduced in Fastify version 5.3.2, as part of the fix for CVE-2025-32442. By prepending a space to the Content-Type header, an attacker can bypass validation entirely, although the body is still parsed correctly. However, [truncated]