mcollina

@fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

fast-uri vulnerable to host confusion via backslash authority introducer

undici vulnerable to downstream response desynchronization via retry interceptor

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici vulnerable to CRLF Injection via blob-like body 'type' property

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For