Ulises Gascón

multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function

undici is vulnerable to CRLF Injection via upgrade option

undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

body-parser vulnerable to denial of service when url encoding is used