Climba03003

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean `false` is a valid schema that rejects all instances. However, when `false` is assigned to a route's `body`, `querystring`, `params`, or `headers` schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named `value` at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions 5.8.3 through 5.12.0 **Description** An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the `trustProxy` setting is configured with a numeric hop-count value, the system fails to properly validate the connecting address. This allows an attacker who can reach the origin directly, bypassing the front-facing proxy, to spoof forwarded request fields. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, as well as host-based routing and cache poisoning. **Recommendations** Update to version 5.12.1. Migrate to an IP, CIDR, or custom-function `trustProxy` value that validates the connecting address. Ensure the origin is only reachable through the trusted proxy chain.

**Name of the Vulnerable Software and Affected Versions** @fastify/multipart versions 3.0.0 through 10.1.0 **Description** An issue exists in the multipart form-data parser where the `saveRequestFiles()` function can leave temporary files on the disk if a client disconnects while the parser is moving between multipart parts. Because the iterator rejection occurs outside the per-file cleanup path, previously completed files are not removed. An unauthenticated client can exploit this behavior to cause persistent, linear disk consumption, resulting in a denial of service. **Recommendations** Upgrade to version 10.1.1.

**Name of the Vulnerable Software and Affected Versions** @fastify/rate-limit versions prior to 11.2.0 **Description** Rate-limit buckets are keyed using the verbatim client IP string from `request.ip`. An IPv6-capable client can bypass rate-limit boundaries by rotating addresses within a large address range (such as a /64) or by using different textual representations of the same address. This allows attackers to bypass protections on sensitive endpoints like authentication, password reset, OTP delivery, or expensive API calls, particularly when the application is behind a proxy that surfaces IPv6 to the origin and `trustProxy` is enabled. **Recommendations** Update to version 11.2.0.

**Name of the Vulnerable Software and Affected Versions** @fastify/http-proxy versions 9.4.0 through 11.5.0 **Description** WebSocket destination paths are not properly validated against the configured rewrite prefix. The `WebSocketProxy.findUpstream()` function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the `ws` package normalize paths before transmission. **Recommendations** Upgrade @fastify/http-proxy to version 11.6.0.

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions 8.3.1 through 12.6.3 **Description** Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identical keys despite resolving to different upstream URLs. Consequently, when `getUpstream()` selects an upstream from request data, a cached URL for one upstream may be reused for a request intended for another, leading to cross-upstream data access and modification. Real-world incidents of elevated activity targeting this issue have been observed. **Recommendations** Upgrade to @fastify/reply-from version 12.6.4. As a temporary workaround, pass `disableCache: true` when registering the plugin.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions prior to 9.3.2 **Description** A middleware bypass exists when the deprecated `ignoreDuplicateSlashes` option is enabled. The middleware path matching logic fails to account for duplicate slash normalization performed by the router, allowing requests with duplicate leading slashes (e.g., '//admin/secret') to bypass authentication and authorization checks. This issue specifically affects applications using the deprecated top-level configuration style `fastify({ ignoreDuplicateSlashes: true })` rather than the `routerOptions` configuration. **Recommendations** Upgrade to @fastify/middie version 9.3.2. As a temporary workaround, migrate from the deprecated top-level `ignoreDuplicateSlashes: true` configuration to `routerOptions: { ignoreDuplicateSlashes: true }` or disable the `ignoreDuplicateSlashes` option.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions prior to 9.3.2 **Description** Inherited middleware is not registered directly on child plugin engine instances. When authentication middleware is registered in a parent scope and child plugins are registered with @fastify/middie, the child scope fails to inherit the parent middleware. This occurs because middleware paths are incorrectly re-prefixed when propagated to child plugin scopes; if a child plugin is registered with a prefix overlapping a parent-scoped middleware path, the path is modified and fails to match incoming requests. Consequently, security controls such as authentication, authorization, and rate limiting are skipped for all routes defined within affected child and nested grandchild plugin scopes, allowing unauthenticated requests to reach those routes. **Recommendations** Upgrade to @fastify/middie version 9.3.2.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** Path traversal occurs when directory listing is enabled via the `list` option. The `dirList.path()` function resolves directories outside the configured static root using `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed. **Recommendations** Upgrade to version 9.1.1. As a temporary workaround, disable directory listing by removing the `list` option from the plugin configuration.

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions prior to 12.6.2 @fastify/http-proxy versions prior to 11.4.4 **Description** A logic flaw in the header processing pipeline of the Node.js Fastify framework allows unauthenticated remote attackers to bypass security controls. The issue occurs because the `rewriteRequestHeaders()` function processes the client's `Connection` header after the proxy has added its own headers. This allows an attacker to retroactively strip headers added by the proxy for routing, access control, or security purposes by listing them in the `Connection` header value. This can lead to unauthorized modification of protected information or the bypass of proxy identification and authorization mechanisms. **Recommendations** Upgrade @fastify/reply-from to version 12.6.2 or later. Upgrade @fastify/http-proxy to version 11.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** An issue exists where the software fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows an unauthenticated attacker to bypass path-scoped authentication middleware by manipulating the URL path. Specifically, the bypass occurs via duplicate slashes when `ignoreDuplicateSlashes` is enabled, or via semicolon delimiters when `useSemicolonDelimiter` is enabled. In these scenarios, the Fastify router normalizes the URL to match the route, but the original un-normalized URL is passed to Express middleware, causing it to fail to match and be skipped. **Recommendations** Upgrade to @fastify/express v4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.5 **Description** A path handling bug in the `onRegister()` function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware path, the path is prefixed a second time, preventing it from matching incoming requests. This leads to a complete bypass of Express middleware security controls, such as authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. **Recommendations** Upgrade to version 4.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions 8.0.0 through 9.1.0 **Description** An authentication and authorization bypass exists due to inconsistent URL decoding between the Fastify router and the static file handler. The router treats percent-encoded path separators (`%2F`) as literal characters, while the static handler decodes them before filesystem resolution. This mismatch allows attackers to circumvent route-based middleware or guards intended to protect specific paths. For example, a request to `/admin%2Fsecret.html` may not match a guard for `/admin/*` but will still be resolved and served as `/admin/secret.html` by the static handler. **Recommendations** Upgrade @fastify/static to version 9.1.1.

**Name of the Vulnerable Software and Affected Versions** fastify versions 5.3.2 through 5.8.4 **Description** Applications using `schema.body.content` for per-content-type body validation are subject to a validation bypass. By prepending a space to the Content-Type header, the body is still parsed correctly, but the schema validation is skipped entirely. **Recommendations** Upgrade to version 5.8.5 or later.