{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9964f265-60ff-59da-a4fc-a044694f2a59", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.0", "type": "library", "bom-ref": "pkg:npm/fastify@5.12.0", "version": "5.12.0", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:57c9f752-36ef-53f8-9099-ea384b18b184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 5.12.0 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in Fastify when processing large JSON payloads without size limits. The fix was added in upstream commit fabd2a01 by Nathan Woltman on 2018-01-07 and released in Fastify v0.38.0 (2018-01-08), approximately 8 years before TuxCare's first commit (2026-02-10). Target version 5.12.0 includes comprehensive body size limit defenses with a default 1 MiB limi...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:c8b3c339-c262-53b3-bbf0-fc62207dbe58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 5.12.0 of fastify. not_affected \u2014 CVE-2020-8192 describes a DoS vulnerability in Fastify v2.14.1 and v3.0.0-rc.4 caused by resource exhaustion when the Ajv `allErrors: true` option is enabled with specially crafted schemas. The target (Fastify v5.12.0-tuxcare.6) is NOT AFFECTED because the vulnerable code pattern is not present. The baseline Ajv configuration explicitly sets `allErrors: false` by default, with documentation sta...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:8b66610e-f84f-54b9-8390-f0f9cb42cf6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 5.12.0 of fastify. not_affected \u2014 Target fastify v5.12.0-tuxcare.6 is not affected by CVE-2022-39288. The vulnerability required using plain JavaScript objects for Content-Type parameter storage, which allowed prototype pollution when malicious headers contained property names like 'constructor' or '__proto__'. The upstream fix (commit fbb07e8d, Oct 2022) replaced plain objects with Map-based storage, preventing prototype pollu...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:f3ff028c-0268-552b-9ebd-2562f3decca9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 5.12.0 of fastify. not_affected \u2014 CVE-2022-41919 (GHSA-3fjj-p79j-c9hh) is a content-type spoofing vulnerability that allowed attackers to bypass CORS preflight checks by sending requests with manipulated Content-Type headers like 'text/plain; content-type=\"application/json\"'. The vulnerability was fixed in Fastify 4.10.2 (commit 62dde76f, November 2022) by implementing proper RFC-compliant Content-Type parsing. The fix is prese...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:cac9fe50-eeb0-5ceb-8882-8665a9da1ac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.12.0 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:6dc22a15-47c4-5bc2-b14d-a65766201ba7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.12.0 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:1fbeb535-eb9e-5b92-9a87-fec85588c557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.12.0 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:2fa09822-a0cf-54ac-b024-b63444307388", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16732 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.1." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:1c07d5d9-e826-54b7-a15c-41abf9291294", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18504 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.1." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:9628b575-1822-5c12-b7b2-e81a8651eb62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25223 affects version 5.12.0 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:cae0feb4-72b2-5b3d-b255-e5fdde51c086", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.12.0 of fastify. not_affected \u2014 The target Fastify 5.12.0-tuxcare.6 is NOT AFFECTED by CVE-2026-25224. The upstream fix for the Web Streams backpressure vulnerability (commit eb11156396f6a5fedaceed0140aed2b7f026be37 by Matteo Collina, dated 2026-02-02) was already present in the upstream release that TuxCare onboarded. The vulnerable pattern\u2014calling res.write() without checking its return value and waiting for the 'drain' eve...", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:18317827-7c49-5000-965f-d4dc1ba1251d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.12.0 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:375587b6-31b7-5414-bda1-ee749ade10d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 5.12.0 of fastify. not_affected \u2014 CVE-2026-3419 affects Fastify's Content-Type header validation, where malformed headers with trailing garbage (e.g., \"application/json garbage\") were incorrectly accepted due to a missing regex anchor. The target version 5.12.0-tuxcare.6 is NOT AFFECTED because the fix was already present in the upstream release 5.12.0 that TuxCare onboarded. The vulnerable regex pattern /^[\\w!#$%&'*+.^`|~-]+\\s...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:8225a27e-e8ae-5798-9f13-2c6cf1d10e95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.12.0 of fastify. not_affected \u2014 The target is not affected by CVE-2026-3635. The upstream fix (commit 4e1db5bd0012ccf63a49ff105a63e25981b9a747) that gates host and protocol getters on the proxy trust function was already present in the upstream Fastify v5.12.0 release that TuxCare onboarded. The vulnerable pattern - reading X-Forwarded-Host and X-Forwarded-Proto headers without validating the connecting IP against the trustPr...", "justification": "code_not_present" } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:10e42b26-4e5b-5e81-a0be-7527de9001ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.2." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:6b630ef9-d4e9-5617-a3b8-8756625f9de2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.4." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:76b593f7-6de8-5662-8b98-4136a6379ed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.2." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:542e5dd8-197b-5803-b14f-483fada6454a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84504 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.3." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.12.0" } ], "bom-ref": "urn:uuid:dc005b66-7704-598e-a11c-7e91d63ffb5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92081 affects version 5.12.0 of fastify, and is fixed in 5.12.0-tuxcare.5." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.12.0" } ] }