UlisesGascon

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

fast-uri vulnerable to host confusion via literal backslash authority delimiter

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins