mcollina

fastify vulnerable to header validation bypass via case-sensitive propertyNames

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/static vulnerable to route guard bypass via path case-folding

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization