mcollina

fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch