Mcollina

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.1.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The dump interceptor reads and discards response bodies up to a configurable maximum size. When a response is chunked and lacks a Content-Length, the interceptor signals completion early once the maximum size is reached without pausing or aborting the request. Since the underlying parser continues to deliver body bytes, a second completion signal triggers an internal assertion that aborts the request and terminates the connection. This results in the application receiving a misleading successful status with an empty or truncated body despite the connection being disconnected. **Recommendations** Update undici versions 7.1.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named `value` at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.15.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The decompress interceptor decompresses response bodies based on the untrusted `Content-Encoding` header. Although the number of encoding layers is capped, the total decompressed output size is unbounded and lacks a configuration limit. A malicious upstream server can send a compression bomb—a small compressed payload that expands to hundreds of megabytes or more in client memory—leading to asymmetric resource consumption that can exhaust memory and crash the process, resulting in a Denial of Service (DoS). **Recommendations** Update undici versions 7.15.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1 **Description** A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including the error listener, while the stream remains active. If a remote peer sends a compressed payload that exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, the inflate stream emits a data error. Because no listener is attached, Node.js treats this as a fatal unhandled error and terminates the process. This allows for a remote, unauthenticated Denial of Service (DoS) attack where a small amount of data (approximately 130 KB) can crash the process. **Recommendations** Upgrade to version 6.28.1 Upgrade to version 7.29.1 Upgrade to version 8.10.2

**Name of the Vulnerable Software and Affected Versions** undici versions 7.24.1 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The `BalancedPool` constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support functions, any function-valued TLS options, such as a custom `checkServerIdentity` callback or a custom connector within the `connect` option, are silently discarded. This can lead to a TLS certificate validation bypass where a peer that should be rejected by a custom `checkServerIdentity` function is accepted if it passes the default Node.js hostname and chain checks. **Recommendations** Update undici versions 7.24.1 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 8.10.0 through 8.10.1 **Description** When the cache or deduplicate interceptor is composed directly onto a Client or Pool, the destination origin is omitted from the cache and request-deduplication keys. This causes the internal cache key to fall back to an empty origin string, allowing a response from one upstream origin to be returned for a request to a different trusted origin if the method, path, and relevant headers match. This leads to cross-origin information disclosure and persistent cache poisoning. A demonstrated impact includes a full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without the trusted origin being contacted. **Recommendations** Upgrade to undici version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.11.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The retry handler can leave a response body pending indefinitely. This occurs when a server provides a successful response with a `Content-Length` but closes the connection after sending only part of the body. If a subsequent retry returns a non-retryable status (such as 400), the handler forwards the new response and replaces the internal response stream, leaving the original response body held by the application neither ended nor destroyed. Consequently, calls reading that body never settle, and the body timeout fails to trigger because the timer is linked to the connection parser rather than the orphaned body. An attacker-controlled server can exploit this by sending two short responses to accumulate pending promises and streams, potentially exhausting application memory or concurrency, leading to a Denial of Service (DoS), which is a condition where a service is unavailable to its intended users. **Recommendations** Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 6.7.0 through 6.28.0 undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The WebSocket client crashes the Node.js process during the opening handshake if a server responds with a subprotocol that the client did not request. When a server's 101 response includes a `Sec-WebSocket-Protocol` header, the client dereferences a null value while validating it against the requested list, triggering an uncaught `TypeError`. Since this occurs within a microtask lacking error handling, the exception terminates the process. This allows a remote attacker controlling a server or performing a machine-in-the-middle attack on a plaintext connection to cause a Denial of Service without authentication. **Recommendations** Upgrade to version 6.28.1 for installations using the 6.x branch. Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The cache interceptor incorrectly handles the caching of unsafe HTTP methods. While documentation states only safe methods are cached, the logic used to skip caching fails to include unsafe methods like POST, PUT, or DELETE in the skip list. Consequently, these requests enter the cache-read path. Additionally, the response-storage gate does not verify the HTTP method, allowing responses to unsafe requests that are heuristically cacheable or contain a Cache-Control directive to be stored. This allows a remote origin to provide a cacheable response that the client will later replay for subsequent state-changing requests, preventing them from reaching the origin and causing an integrity failure. **Recommendations** Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.3 **Description** A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows a request using an absolute-form target to reach the route handler while skipping path-scoped middleware used for authentication, authorization, rate limiting, or auditing. An unauthenticated network attacker can exploit this behavior to bypass path-based access controls. **Recommendations** Update @fastify/middie to version 9.3.4 or later. As a workaround, enforce authentication using a Fastify hook such as `preHandler()`.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing property keys and the root-level required array, but it fails to lowercase the trigger and dependent names within the JSON Schema Draft 7 dependencies keyword. Since Node.js stores request header names in lowercase, dependencies using canonical-case names never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a header that activates a privileged branch while omitting a required header, thereby bypassing conditional checks. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The cache interceptor fails to handle the `Set-Cookie` response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheable response contains a `Set-Cookie` header, such as those with public and max-age directives. Consequently, a cookie belonging to one user may be disclosed to another user, or an untrusted server could inject cookies into cached responses served to subsequent callers, violating the requirement that shared caches must not store cookies. **Recommendations** Update undici versions 7.0.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 **Description** The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During an unclean close, the internal socket-close handler calls abort on the writable stream and discards the returned promise. According to the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError. Since the application holds a writer on that writable, the rejection is not observed, triggering Node's default unhandled-rejection behavior which terminates the process. This allows an untrusted server to cause a Denial of Service by abruptly disconnecting. **Recommendations** Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.28.1 undici versions 7.0.0 through 7.29.1 undici versions 8.0.0 through 8.10.2 **Description** The retry interceptor can append the body of a ranged retry response to bytes already delivered from a previous partial response while maintaining the original response status and headers. This occurs when an upstream server provides part of a body without a trustworthy resume checkpoint—such as a non-success response with already sent headers or a partial-content response with an unusable content range—closes the connection, and then provides more bytes in the resumed range request. Consequently, the response body may exceed the `Content-Length` observed by the application. If an application relays this response to a downstream HTTP/1.1 peer without normalizing the framing, the excess bytes may be interpreted as the start of a subsequent response, leading to downstream response splitting or desynchronization. This requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. **Recommendations** Update to version 6.28.1 for versions prior to 6.28.1. Update to version 7.29.1 for versions 7.0.0 through 7.29.1. Update to version 8.10.2 for versions 8.0.0 through 8.10.2.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean `false` is a valid schema that rejects all instances. However, when `false` is assigned to a route's `body`, `querystring`, `params`, or `headers` schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions 4.0.0 through 5.12.1 **Description** An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/http-proxy versions prior to 11.6.2 **Description** An unauthenticated network attacker can exploit a path traversal issue where proxied HTTP request paths are not validated for backslash-based dot-segments before being forwarded to the upstream server. The plain HTTP request handler bypasses the destination validation used by WebSocket paths, and the underlying `reply-from` library only rejects forward-slash traversal. This allows requests containing backslash dot-segments to escape the boundaries defined by the `prefix` and `rewritePrefix` options, enabling access to internal upstream paths and the disclosure of hidden endpoints. **Recommendations** Upgrade to @fastify/http-proxy version 11.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4 **Description** The `parse()` function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with an opening bracket but lacking a closing bracket is not validated as an IP literal or canonicalized as a domain name. Consequently, the function returns the host with an undefined error, whereas Node's URL and associated HTTP clients resolve the string to a different host. This discrepancy can lead to host confusion in applications using the parsed host for security decisions, such as SSRF denylists, redirect allowlists, or proxy routing, as the policy is evaluated against a string different from the actual destination host. This behavior also persists through the `normalize`, `equal`, and `resolve` functions. **Recommendations** Update to version 2.4.6 or later. Update to version 3.1.7 or later. Update to version 4.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 2.4.6 fast-uri versions 3.0.0 through 3.1.6 fast-uri versions 4.0.0 through 4.1.3 **Description** The software serializes the port component of a URI without proper validation. During the recomposition of the authority, the port is concatenated verbatim while the userinfo and host components are escaped. This allows a port value containing non-digit characters to inject authority delimiters, which can demote the intended host to userinfo and redirect the authority to an attacker-controlled host. This issue occurs in applications that construct URIs from parts and assign untrusted data to the port component using the `serialize`, `normalize`, or `equal` functions in their object forms. **Recommendations** Update to version 2.4.6. Update to version 3.1.7. Update to version 4.1.4.