Climba03003

Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean `false` is a valid schema that rejects all instances. However, when `false` is assigned to a route's `body`, `querystring`, `params`, or `headers` schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations.

An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named `value` at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure.

An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the `trustProxy` setting is configured with a numeric hop-count value, the system fails to properly validate the connecting address. This allows an attacker who can reach the origin directly, bypassing the front-facing proxy, to spoof forwarded request fields. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, as well as host-based routing and cache poisoning.

An issue exists in the multipart form-data parser where the `saveRequestFiles()` function can leave temporary files on the disk if a client disconnects while the parser is moving between multipart parts. Because the iterator rejection occurs outside the per-file cleanup path, previously completed files are not removed. An unauthenticated client can exploit this behavior to cause persistent, linear disk consumption, resulting in a denial of service.

Rate-limit buckets are keyed using the verbatim client IP string from `request.ip`. An IPv6-capable client can bypass rate-limit boundaries by rotating addresses within a large address range (such as a /64) or by using different textual representations of the same address. This allows attackers to bypass protections on sensitive endpoints like authentication, password reset, OTP delivery, or expensive API calls, particularly when the application is behind a proxy that surfaces IPv6 to the origin and `trustProxy` is enabled.

WebSocket destination paths are not properly validated against the configured rewrite prefix. The `WebSocketProxy.findUpstream()` function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the `ws` package normalize paths before transmission.

Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identical keys despite resolving to different upstream URLs. Consequently, when `getUpstream()` selects an upstream from request data, a cached URL for one upstream may be reused for a request intended for another, leading to cross-upstream data access and modification. Real-world incidents of elevated activity targeting this issue have been observed.

A middleware bypass exists when the deprecated `ignoreDuplicateSlashes` option is enabled. The middleware path matching logic fails to account for duplicate slash normalization performed by the router, allowing requests with duplicate leading slashes (e.g., '//admin/secret') to bypass authentication and authorization checks. This issue specifically affects applications using the deprecated top-level configuration style `fastify({ ignoreDuplicateSlashes: true })` rather than the `routerOptions` configuration.

Inherited middleware is not registered directly on child plugin engine instances. When authentication middleware is registered in a parent scope and child plugins are registered with @fastify/middie, the child scope fails to inherit the parent middleware. This occurs because middleware paths are incorrectly re-prefixed when propagated to child plugin scopes; if a child plugin is registered with a prefix overlapping a parent-scoped middleware path, the path is modified and fails to match incoming requests. Consequently, security controls such as authentication, authorization, and rate limiting are skipped for all routes defined within affected child and nested grandchild plugin scopes, allowing unauthenticated requests to reach those routes.

Path traversal occurs when directory listing is enabled via the `list` option. The `dirList.path()` function resolves directories outside the configured static root using `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed.

A logic flaw in the header processing pipeline of the Node.js Fastify framework allows unauthenticated remote attackers to bypass security controls. The issue occurs because the `rewriteRequestHeaders()` function processes the client's `Connection` header after the proxy has added its own headers. This allows an attacker to retroactively strip headers added by the proxy for routing, access control, or security purposes by listing them in the `Connection` header value. This can lead to unauthorized modification of protected information or the bypass of proxy identification and authorization mechanisms.

An issue exists where the software fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows an unauthenticated attacker to bypass path-scoped authentication middleware by manipulating the URL path. Specifically, the bypass occurs via duplicate slashes when `ignoreDuplicateSlashes` is enabled, or via semicolon delimiters when `useSemicolonDelimiter` is enabled. In these scenarios, the Fastify router normalizes the URL to match the route, but the original un-normalized URL is passed to Express middleware, causing it to fail to match and be skipped.

A path handling bug in the `onRegister()` function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware path, the path is prefixed a second time, preventing it from matching incoming requests. This leads to a complete bypass of Express middleware security controls, such as authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes.

An authentication and authorization bypass exists due to inconsistent URL decoding between the Fastify router and the static file handler. The router treats percent-encoded path separators (`%2F`) as literal characters, while the static handler decodes them before filesystem resolution. This mismatch allows attackers to circumvent route-based middleware or guards intended to protect specific paths. For example, a request to `/admin%2Fsecret.html` may not match a guard for `/admin/*` but will still be resolved and served as `/admin/secret.html` by the static handler.

Applications using `schema.body.content` for per-content-type body validation are subject to a validation bypass. By prepending a space to the Content-Type header, the body is still parsed correctly, but the schema validation is skipped entirely.