{ "@id": "urn:uuid:1cd05fa2-6062-40ea-8581-fd6321b14342", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:09:00.106872+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T04:05:30.119451+00:00", "status_notes": "Vulnerability CVE-2018-3711 does not affect version 5.7.4 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in fastify versions before 0.38.0 where unbounded JSON body parsing could exhaust server resources. The fix (commit fabd2a01 by Nathan Woltman) introduced a configurable bodyLimit option (default 1MB) in v0.38.0 (January 2018). The target version 5.7.4-tuxcare.6 is far beyond 0.38.0 and contains the upstream fix. The vulnerable unbounded parsing patte...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-3711" }, "impact_statement": "not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in fastify versions before 0.38.0 where unbounded JSON body parsing could exhaust server resources. The fix (commit fabd2a01 by Nathan Woltman) introduced a configurable bodyLimit option (default 1MB) in v0.38.0 (January 2018). The target version 5.7.4-tuxcare.6 is far beyond 0.38.0 and contains the upstream fix. The vulnerable unbounded parsing patte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T04:06:37.843142+00:00", "status_notes": "Vulnerability CVE-2020-8192 does not affect version 5.7.4 of fastify. not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 with a DoS vulnerability when the `allErrors` option is enabled. The vulnerability was fixed in upstream Fastify v2.15.1 (June 29, 2020) by commit 627096fb, which disabled `allErrors` by default. The current target version 5.7.4-tuxcare.6 includes this upstream fix, setting `allErrors: false` explicitly to prevent the DoS attack vector. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8192" }, "impact_statement": "not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 with a DoS vulnerability when the `allErrors` option is enabled. The vulnerability was fixed in upstream Fastify v2.15.1 (June 29, 2020) by commit 627096fb, which disabled `allErrors` by default. The current target version 5.7.4-tuxcare.6 includes this upstream fix, setting `allErrors: false` explicitly to prevent the DoS attack vector. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T04:08:00.063941+00:00", "status_notes": "Vulnerability CVE-2022-39288 does not affect version 5.7.4 of fastify. not_affected \u2014 CVE-2022-39288 affects only Fastify v4.x (fixed in >v4.8.0). The target version 5.7.4 is NOT affected because the vulnerable code pattern does not exist in v5.x. The vulnerability involved using plain JavaScript objects to store Content-Type parsers, allowing prototype pollution attacks via malicious header values. Fastify v5.x uses Map data structures instead, which are immune to prototype pol...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39288" }, "impact_statement": "not_affected \u2014 CVE-2022-39288 affects only Fastify v4.x (fixed in >v4.8.0). The target version 5.7.4 is NOT affected because the vulnerable code pattern does not exist in v5.x. The vulnerability involved using plain JavaScript objects to store Content-Type parsers, allowing prototype pollution attacks via malicious header values. Fastify v5.x uses Map data structures instead, which are immune to prototype pol..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T04:09:00.092723+00:00", "status_notes": "Vulnerability CVE-2022-41919 does not affect version 5.7.4 of fastify. not_affected \u2014 CVE-2022-41919 describes a Content-Type spoofing vulnerability where attackers could bypass CORS preflight checks by using \"simple\" Content-Types (text/plain, application/x-www-form-urlencoded, multipart/form-data) with spoofed parameters like `text/plain; content-type=\"application/json\"` to invoke JSON-only routes. The target (Fastify 5.7.4) contains the upstream fix (commit 62dde76f from Nove...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41919" }, "impact_statement": "not_affected \u2014 CVE-2022-41919 describes a Content-Type spoofing vulnerability where attackers could bypass CORS preflight checks by using \"simple\" Content-Types (text/plain, application/x-www-form-urlencoded, multipart/form-data) with spoofed parameters like `text/plain; content-type=\"application/json\"` to invoke JSON-only routes. The target (Fastify 5.7.4) contains the upstream fix (commit 62dde76f from Nove..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32442 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.2.", "vulnerability": { "name": "CVE-2025-32442" }, "action_statement": "Vulnerability CVE-2025-32442 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-02T10:49:53.224717+00:00", "status_notes": "Vulnerability CVE-2026-107832 affects version 5.7.4 of fastify.", "vulnerability": { "name": "CVE-2026-107832" }, "action_statement": "Vulnerability CVE-2026-107832 affects version 5.7.4 of fastify." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T08:09:00.106872+00:00", "status_notes": "Vulnerability CVE-2026-120216 does not affect version 5.7.4 of fastify. not_affected \u2014 Version 5.7.4 is NOT affected by CVE-2026-120216. The vulnerability exists in the handlerTimeout feature, which was introduced in version 5.8.0 (commit f376f6082b5ddfe5ea96fdd3d98a66377b6bb4c2) and does not exist in 5.7.4. The CVE's stated affected range (5.8.0 through 5.12.7) is accurate. Exhaustive searches confirmed that handlerTimeout configuration, kTimeoutTimer symbol, and FST_ERR_HANDLER...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120216" }, "impact_statement": "not_affected \u2014 Version 5.7.4 is NOT affected by CVE-2026-120216. The vulnerability exists in the handlerTimeout feature, which was introduced in version 5.8.0 (commit f376f6082b5ddfe5ea96fdd3d98a66377b6bb4c2) and does not exist in 5.7.4. The CVE's stated affected range (5.8.0 through 5.12.7) is accurate. Exhaustive searches confirmed that handlerTimeout configuration, kTimeoutTimer symbol, and FST_ERR_HANDLER..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-02T10:49:53.224717+00:00", "status_notes": "Vulnerability CVE-2026-16732 affects version 5.7.4 of fastify.", "vulnerability": { "name": "CVE-2026-16732" }, "action_statement": "Vulnerability CVE-2026-16732 affects version 5.7.4 of fastify." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-18504 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18504" }, "action_statement": "Vulnerability CVE-2026-18504 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-02T10:49:00.165420+00:00", "status_notes": "Vulnerability CVE-2026-25223 affects version 5.7.4 of fastify.", "vulnerability": { "name": "CVE-2026-25223" }, "action_statement": "Vulnerability CVE-2026-25223 affects version 5.7.4 of fastify." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-11-04T04:09:00.092723+00:00", "status_notes": "Vulnerability CVE-2026-25224 does not affect version 5.7.4 of fastify. not_affected \u2014 The target Fastify version 5.7.4-tuxcare.6 is not affected by CVE-2026-25224. The vulnerability (unbounded buffering in Web Streams response handling) was fixed in upstream Fastify 5.7.3 via commit eb11156396f6a5fedaceed0140aed2b7f026be37, authored by Matteo Collina. This fix was already present in the upstream 5.7.4 release that TuxCare onboarded, requiring no separate backport for this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25224" }, "impact_statement": "not_affected \u2014 The target Fastify version 5.7.4-tuxcare.6 is not affected by CVE-2026-25224. The vulnerability (unbounded buffering in Web Streams response handling) was fixed in upstream Fastify 5.7.3 via commit eb11156396f6a5fedaceed0140aed2b7f026be37, authored by Matteo Collina. This fix was already present in the upstream 5.7.4 release that TuxCare onboarded, requiring no separate backport for this versio..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33806 affects version 5.7.4 of fastify.", "vulnerability": { "name": "CVE-2026-33806" }, "action_statement": "Vulnerability CVE-2026-33806 affects version 5.7.4 of fastify." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3419 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-3419" }, "action_statement": "Vulnerability CVE-2026-3419 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3635 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-3635" }, "action_statement": "Vulnerability CVE-2026-3635 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-01T16:12:27.733279+00:00", "status_notes": "Vulnerability CVE-2026-76169 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-76169" }, "action_statement": "Vulnerability CVE-2026-76169 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-84428 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5.", "vulnerability": { "name": "CVE-2026-84428" }, "action_statement": "Vulnerability CVE-2026-84428 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-84469 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5.", "vulnerability": { "name": "CVE-2026-84469" }, "action_statement": "Vulnerability CVE-2026-84469 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-03T11:49:00.929976+00:00", "status_notes": "Vulnerability CVE-2026-84504 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.4.", "vulnerability": { "name": "CVE-2026-84504" }, "action_statement": "Vulnerability CVE-2026-84504 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-12T12:03:00.098286+00:00", "status_notes": "Vulnerability CVE-2026-92081 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5.", "vulnerability": { "name": "CVE-2026-92081" }, "action_statement": "Vulnerability CVE-2026-92081 affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/fastify@5.7.4", "identifiers": { "purl": "pkg:npm/fastify@5.7.4" } } ], "timestamp": "2026-10-01T16:12:27.733279+00:00", "status_notes": "Vulnerability GHSA-gm8r-x7h4-fm5r affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.3.", "vulnerability": { "name": "GHSA-gm8r-x7h4-fm5r" }, "action_statement": "Vulnerability GHSA-gm8r-x7h4-fm5r affects version 5.7.4 of fastify, and is fixed in 5.7.4-tuxcare.3." } ] }