mcollina

@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook

@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

fast-uri vulnerable to improper path equivalence in relative reference normalization