UlisesGascon

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/static vulnerable to route guard bypass via path case-folding

path-to-regexp vulnerable to Denial of Service via sequential optional groups

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

moment vulnerable to Path Traversal via crafted non-string locale name

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads