@fastify/static vulnerable to route guard bypass via non-canonical path segments

### Impact `@fastify/static` 10.1.2 and earlier is vulnerable to a bypass of route-based middleware and guards via non-canonical `.` and `//` path segments. `find-my-way` does not normalize `.` se...

github.com

@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

### Impact `@fastify/aws-lambda@6.4.0` decorates every request with `request.awsLambda.event` and `request.awsLambda.context`, which handlers use to read the API Gateway event, including `reques...

github.com

fast-uri vulnerable to host confusion via backslash authority introducer

### Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\`, `/\`, or `\/` as the authority introducer (in place of `//`, after an...

github.com

July 2026 Security Releases · Express.js

A security release for body-parser has been published. We recommend that all users upgrade as soon as possible.

expressjs.com

undici vulnerable to CRLF Injection via blob-like body 'type' property

### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrust...

github.com

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

## Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache ="authorization"...

github.com

undici vulnerable to downstream response desynchronization via retry interceptor

### Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length` header exposed to the application after a retry or resume of a partial respo...

github.com

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `examp...

github.com

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared-cache disclosure (CWE-200, CWE-525):** Responses with malformed qualified `C...

github.com

@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

### Impact `@fastify/rate-limit` `<= 11.1.0` keys rate-limit buckets by the verbatim client IP string returned from `request.ip`. Combined with two properties of IPv6 (prefix allocation per RFC 61...

github.com

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

### Impact `@fastify/forwarded` resolves client addresses from the `X-Forwarded-For` header. When the header contains two or more comma-separated entries, the parser trims only space characters ...

github.com

2026 Community Sponsorships

Today, we are happy to announce that Mocha will be donating $5,000 each to four different community projects, for a total of $20,000 donated to the modern JavaScript community.

mochajs.org

@fastify/static vulnerable to route guard bypass via path traversal

### Impact `@fastify/static` is vulnerable to a bypass of route-based middleware and guards via non-leading `..` and `%2E%2E` path segments. `find-my-way` does not normalize `..` when matching r...

github.com

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

### Impact `@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as ...

github.com

Por qué rechazamos la mayoría de los reportes de vulnerabilidades en Lodash

Cerca del 95% de los reportes de seguridad que recibe Lodash se rechazan, incluso cuando la prueba de concepto funciona. Aquí explico cómo el threat model decide dónde termina un bug de la librería y ...

blog.ulisesgascon.com

Why Most Lodash Vulnerability Reports Get Rejected

Around 95% of the security reports Lodash receives get rejected, even when the proof of concept runs. Here is how the threat model decides where a library bug ends and an application bug begins, the p...

blog.ulisesgascon.com

What Is a CVE and Why Should You Care? | Café con CVEs Ep. 1 (Spanish)

YouTube video by NodeSource official

youtube.com

fast-uri vulnerable to host confusion via literal backslash authority delimiter

### Impact `fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` c...

github.com

@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

### Impact `@fastify/http-proxy` v11.5.0 and earlier fails to rewrite the request prefix when the client uses percent-encoded characters in the prefix portion of the URL. Fastify's router URL-de...

github.com

@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

# `@fastify/http-proxy` - WebSocket prefix escape (variant of CVE-2021-21322) ## Summary `@fastify/http-proxy` restricts which upstream subtree is reachable by rewriting the request path from...

github.com

@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

### Impact `@fastify/reply-from` v12.6.3 and earlier compute the internal URL cache key as the concatenation `dest + source`. Because there is no delimiter between the two values, different `(dest...

github.com

2026-07-09 - Node.js Security Working Group Monthly Meeting

YouTube video by node.js

youtube.com

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently...

github.com

Release 1.20.6 · expressjs/body-parser

What's Changed fix: improve limit option validation by @Phillip9587 in #741 Full Changelog: 1.20.5...1.20.6

github.com

Newsletter #015: A Break from Survival Mode 🥹

After a rough, overloaded stretch, I have taken on a new role as the Node.js AI Security Engineer in Residence, funded by Alpha-Omega. From there we dig into the OpenJS CNA API PoC I built to let proj...

blog.ulisesgascon.com

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade t...

github.com

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

### Impact The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request ori...

github.com

@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

### Impact `@fastify/middie` versions `>= 9.1.0, <= 9.3.2` crash with an uncaught `URIError` when normalizing requests that contain malformed percent-encoded paths (such as `/%zz`, `/%`, or trunca...

github.com