{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9b96d16b-13fe-56c3-ba39-4703828497a3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@4.29.1-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/fastify@4.29.1-tuxcare.5", "version": "4.29.1-tuxcare.5", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@4.29.1", "type": "library", "version": "4.29.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:1c160740-7078-5272-ab4e-497cbf0b2ad6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 4.29.1-tuxcare.5 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in fastify versions prior to 0.38.0 when processing JSON requests with very large payloads. The fix (bodyLimit protection) was added by upstream contributor Nathan Woltman in commit fabd2a01 and released in v0.38.0 on 2018-01-08. The target version 4.29.1-tuxcare.7 is much later and contains the complete defense implementation with a default 1 MB body...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:55351bac-4bd1-5094-adc1-3b54353755c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 4.29.1-tuxcare.5 of fastify. not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 when the AJV `allErrors: true` option is enabled, allowing DoS attacks via specially crafted schemas. The target (Fastify 4.29.1-tuxcare.7) is not affected because the upstream vendor fixed this vulnerability in commit 627096fb (June 29, 2020) by changing the default AJV configuration from `allErrors: true` to `allErrors: false`. This fix sh...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:88c01197-75da-5bcf-84d9-cebf3ce0de9f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 4.29.1-tuxcare.5 of fastify. not_affected \u2014 CVE-2022-39288 (prototype pollution via malicious Content-Type header) is NOT present in fastify 4.29.1-tuxcare.7. The vulnerability was fixed in upstream fastify v4.8.1 (commit fbb07e8d, October 2022) by converting the customParsers object to a Map, preventing prototype pollution attacks. This upstream fix was already present in the release that TuxCare onboarded, before any TuxCare modificati...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ac08d556-286a-5cdd-b52f-acf6e2823ee6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 4.29.1-tuxcare.5 of fastify. not_affected \u2014 CVE-2022-41919 (content-type bypass enabling CSRF) is NOT present in fastify 4.29.1. The vulnerability was fixed in upstream commit 62dde76f (Nov 21, 2022) which introduced proper content-type parsing using the `content-type` npm package and the `compareContentType`/`ParserListItem` infrastructure. This fix shipped in the upstream 4.10.2 release, which predates the 4.29.1 base that TuxCare onbo...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e1bf4ff9-fc46-551a-8d6b-4910f6a076fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32442 does not affect version 4.29.1-tuxcare.5 of fastify. already_fixed \u2014 The target repository fastify 4.29.1-tuxcare.1 already contains the complete fix for CVE-2025-32442. Both security patches that normalize Content-Type header parsing (adding trim, lowercase, and space-as-delimiter handling) have been backported to the 4.29.x branch and are present in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:dc39bacb-c728-5f12-b637-8dbcbd753cdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c6794946-bb4f-5025-8b0b-1e200511c526", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120216 does not affect version 4.29.1-tuxcare.5 of fastify. not_affected \u2014 CVE-2026-120216 affects fastify versions 5.8.0-5.12.7 when handlerTimeout is configured. The target version 4.29.1-tuxcare.7 does not contain the handlerTimeout feature, which was introduced in v5.8.0 (commit f376f608, Feb 26, 2026). Without this feature, the vulnerability cannot manifest. Type A1: Input not received (handlerTimeout configuration option does not exist).", "justification": "code_not_present" } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:b00cd777-b826-5c37-930d-cb1dd4d03f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16732 affects version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:bbf614bd-88bc-5bca-a3ab-2cac1782b72f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18504 is fixed in version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:7c961fcd-aeaa-524c-b8b6-b403eb03cea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25223 is fixed in version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:7a506194-c667-5472-9ce1-4a025569e2a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25224 is fixed in version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:0538b8ab-52ca-578e-8286-3f7e8c607633", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:5ab8d9ad-963d-53f0-8d63-b0b3ba872ae7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 4.29.1-tuxcare.5 of fastify. already_fixed \u2014 The target repository (Fastify 4.29.1-tuxcare.1) already contains a fix that protects against CVE-2026-3419. The fix was applied as part of the CVE-2026-25223 backport in commit 256e54cf (Feb 12, 2026), which introduced lib/content-type.js with strict subtype validation using regex /^[\\w!#$%&'*+.^`|~-]+$/ including the terminating anchor ($). This regex is even stricter than the upstream CVE-20...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:35504c37-1a0f-5a33-a835-446b693e4357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3635 is fixed in version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:4f0e94f2-3bd2-56c3-92ba-3ba0c1757454", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 4.29.1-tuxcare.5 of fastify, and is fixed in 4.29.1-tuxcare.7." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:72da0185-9dff-582a-881c-7ce63164585f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 4.29.1-tuxcare.5 of fastify, and is fixed in 4.29.1-tuxcare.7." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:fd234359-2ddc-5fa5-9dff-fe4349b8375a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 4.29.1-tuxcare.5 of fastify, and is fixed in 4.29.1-tuxcare.6." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:d15e21e3-889d-57b0-afb9-ed9ab5b3f096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84504 is fixed in version 4.29.1-tuxcare.5 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ], "bom-ref": "urn:uuid:91eb2439-9958-5b23-a191-f7ac7a972267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92081 is fixed in version 4.29.1-tuxcare.5 of fastify." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@4.29.1-tuxcare.5" } ] }