{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1e993802-2a3e-554d-887a-4781dbd3d364", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.1-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/fastify@5.12.1-tuxcare.2", "version": "5.12.1-tuxcare.2", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.1", "type": "library", "version": "5.12.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:77139acf-3e9c-5225-9308-00502f19482a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability when processing large JSON payloads without size limits. The target (fastify 5.12.1-tuxcare.5) is NOT AFFECTED because the vulnerable pattern (unbounded JSON body parsing) was removed by an upstream fix in commit fabd2a01 (December 2017, merged before v0.38.0). This fix introduced a default bodyLimit of 1MB that validates request sizes and rejects ove...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:cb29eeb8-1d49-524b-8e68-372a26dc4896", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 where allErrors: true was enabled by default in Ajv configuration, allowing DoS via resource exhaustion with specially crafted schemas. The target version (v5.12.1-tuxcare.5) is not affected because upstream commit 627096fb (June 29, 2020) by Matteo Collina disabled allErrors by default with explicit DoS warning. This fix shipped in the upst...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:79e47f35-3146-5a33-af42-37c0d155b98b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2022-39288 affects fastify v4.x (before v4.8.1) where malicious Content-Type headers containing Object.prototype property names (__proto__, constructor, etc.) could cause application crashes via prototype pollution. The target v5.12.1-tuxcare.5 is not affected because the upstream fix (commit fbb07e8d, Oct 10 2022) was already present in v5.0.0. The fix replaced the vulnerable plain object ...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:0e3cb335-c356-579a-a8c9-de719c4b10ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2022-41919 (Content-Type spoofing for CORS bypass) is NOT AFFECTED in fastify 5.12.1-tuxcare.5. The vulnerability was fixed in upstream v4.10.2 (Nov 2022) and refactored in v5.7.2 (Jan 2026, commit 32d7b6ad). The fix validates Content-Type headers before parser selection, rejecting malformed headers with 415 status. The fix was already present in the upstream release when TuxCare began main...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:76a478d0-4b79-5754-a835-020d2f00f7c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:0662eeb3-846a-516c-9e47-55d7433cddf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:30ebc1f3-d641-53e9-b078-14daa9bf4cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:8728b85e-7d34-5a07-af15-0278120bbbab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-16732 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-16732 is not present in the target. The fix (commit 8acfea7e) that disables numeric trustProxy was already included in the upstream Fastify 5.12.1 release before TuxCare onboarded it. The vulnerable pattern (hop-count predicate that ignores address validation) has been replaced with a fail-closed defense that always returns false for numeric trustProxy configuration, preventing X-Forwa...", "justification": "code_not_present" } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:50d474d7-c57a-59a4-bb9a-8aaefaf498a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-18504 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 The target fastify 5.12.1-tuxcare.5 is NOT affected by CVE-2026-18504. The vulnerability (root primitive body values validated after coercion but exposed uncoerced to handlers) was fixed in upstream fastify commit 1ef8a60c by Matteo Collina before TuxCare onboarded version 5.12.1. The fix is present at lib/validation.js lines 291-300, providing parentData/parentDataProperty to the Ajv validator...", "justification": "code_not_present" } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:40486a68-a9d9-56f0-ae93-5648d4745c66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25223 affects version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:abb12b4d-dc42-5f63-a7eb-144db8a75b54", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-25224 (Denial of Service via unbounded buffering in Web Streams response handling) is NOT present in the target. The vulnerability fix was already included in the upstream Fastify release before TuxCare onboarded version 5.12.1. The fix (commit eb11156396f6a5fedaceed0140aed2b7f026be37) was authored by upstream maintainer Matteo Collina and is present in HEAD's ancestry, predating the f...", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:a6d64c85-de44-5063-b630-7484e0a177e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:ccc36b95-b91e-5ce6-84bf-874557e5ca61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 Target repository fastify 5.12.1-tuxcare.5 (SHA 3b12cebc) is NOT AFFECTED by CVE-2026-3419. The vulnerability pattern is not present because the upstream fix was already included in the shipped version. The fix adds a `$` anchor to the subtypeNameReg regex in lib/content-type.js (line 60), changing it from `/^[\\w!#$%&'*+.^`|~-]+\\s*/` to `/^[\\w!#$%&'*+.^`|~-]+\\s*$/`. This prevents malformed Cont...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:23c264dc-8192-55b2-84e1-45dd8f98d8aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.12.1-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-3635 affects fastify <= 5.8.2 by allowing untrusted connections to spoof request.host and request.protocol via X-Forwarded-Host and X-Forwarded-Proto headers when trustProxy uses restrictive configurations. The target (fastify 5.12.1-tuxcare.5) is NOT AFFECTED because the upstream vendor already fixed this vulnerability in commit 8acfea7e ('fix: disable numeric trustProxy hop-count tru...", "justification": "code_not_present" } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:2b292fc4-9023-5637-adb2-f2bf633d3baa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-76169 is fixed in version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:dc75b078-e7f1-55ce-bd2e-f66011ce02d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.12.1-tuxcare.2 of fastify, and is fixed in 5.12.1-tuxcare.5." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:a2d0ea23-4d26-5df4-9d15-640a13335bfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84469 is fixed in version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:152f2acc-fb9d-5d7d-bf9a-d5a173b5bfa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84504 is fixed in version 5.12.1-tuxcare.2 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:923ce7c9-8ef2-59c5-8b73-622cb6b0908b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92081 affects version 5.12.1-tuxcare.2 of fastify, and is fixed in 5.12.1-tuxcare.3." } }, { "id": "GHSA-gm8r-x7h4-fm5r", "affects": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ], "bom-ref": "urn:uuid:952cec49-82c0-5c84-b841-b78080a276a7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gm8r-x7h4-fm5r is fixed in version 5.12.1-tuxcare.2 of fastify." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.12.1-tuxcare.2" } ] }