These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-15631 is a high-severity vulnerability in @fastify/http-proxy versions from 9.4.0 to 11.5.0. The issue allows path traversal attacks via WebSocket upgrade requests, potentially exposing upstream endpoints not meant to be accessed through the proxy. This vulnerability arises from the failure to validate the resolved WebSocket destination path against the configured rewrite prefix. Exploitation req [truncated]
A critical authentication bypass vulnerability exists in @fastify/express versions 4.0.4 and earlier. When Fastify router normalization options—specifically `ignoreDuplicateSlashes` or `useSemicolonDelimiter`—are enabled, the Fastify router normalizes incoming URLs to match protected routes, but @fastify/express passes the original un-normalized URL to Express middleware. This causes path-scoped authentic [truncated]
A critical path-handling vulnerability in @fastify/express versions 4.0.4 and earlier allows complete bypass of Express middleware security controls in child plugin scopes. The flaw resides in the `onRegister` function, which incorrectly doubles middleware paths when they are inherited by child plugins. When a child plugin is registered with a prefix that matches an existing middleware path, the middlewar [truncated]
CVE-2026-33806 is a high-severity vulnerability affecting Fastify applications that utilize schema.body.content for per-content-type body validation. The issue arises from a regression introduced in Fastify version 5.3.2, as part of the fix for CVE-2025-32442. By prepending a space to the Content-Type header, an attacker can bypass validation entirely, although the body is still parsed correctly. However, [truncated]