UlisesGascon

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

fast-uri vulnerable to improper path equivalence in relative reference normalization

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects