UlisesGascon

multer vulnerable to Denial of Service via oversized array index in field names

morgan vulnerable to Log Forging via unescaped Unicode line separators

hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch