UlisesGascon

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

fastify vulnerable to request validation bypass via skipped boolean false schemas