chore(deps): update dependency fastify to v5.12.1 [security] - #21
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.8.5→5.12.1fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CVE-2026-16732 / GHSA-3m5p-2c4r-xxw2
More information
Details
Impact
The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a
proxyFn(socket.remoteAddress, 0)guard on theX-Forwarded-*reads inrequest.host,request.protocol,request.hostname,request.ip, andrequest.ips. That guard closes the IP, CIDR, and custom-function forms oftrustProxycorrectly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to0 < tp, always true for anytp >= 1.Applications configured with
trustProxy: <number>(documented as "behind N reverse proxies",trustProxy: 1being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.Patches
Patched in fastify 5.12.1. The numeric form of
trustProxyis now disabled at runtime and removed from the TypeScript type union.Workarounds
trustProxyvalue that validates the connecting address. Custom functions must inspect theaddressargument, not only the hop index.Severity
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
CVE-2026-18504 / GHSA-w2qp-rph6-63g4
More information
Details
Impact
fastifybefore 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body"10"is coerced to the number10and passes an integer 1 to 10 schema, butrequest.bodystays the string"10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.Patches
Upgrade to
fastify5.12.1.Workarounds
Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept
{ "value": 10 }and readrequest.body.value, or re-check the type in the handler.Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
fastify/fastify (fastify)
v5.12.1Compare Source
What's Changed
Full Changelog: fastify/fastify@v5.12.0...v5.12.1
v5.12.0Compare Source
What's Changed
Reply.prototype.mediaTypeby @github-actions[bot] in #6946undefinedfor invalid media types by @github-actions[bot] in #6947Full Changelog: fastify/fastify@v5.11.3...v5.12.0
v5.11.3Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.11.2...v5.11.3
v5.11.2Compare Source
v5.11.1Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.11.0...v5.11.1
v5.11.0Compare Source
What's Changed
Content-Typeparameter values by @aquie00t in #6865New Contributors
Full Changelog: fastify/fastify@v5.10.0...v5.11.0
v5.10.0Compare Source
v5.9.0Compare Source
What's Changed
findwithsomeinhasKeyfor correct boolean semantics by @aquie00t in #6759AssertionErrorwithFST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTEREDincheckDependenciesby @aquie00t in #6774New Contributors
Full Changelog: fastify/fastify@v5.8.5...v5.9.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.