{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7570da06-3d75-539c-b609-a03244844b87", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@3.29.5-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/fastify@3.29.5-tuxcare.6", "version": "3.29.5-tuxcare.6", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@3.29.5", "type": "library", "version": "3.29.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:5dfe05c2-ae70-556b-9414-07e65803d4b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 CVE-2018-3711 affects fastify versions before 0.38.0, which was released in January 2018. The target version 3.29.5 (released April 2022, over 4 years later) already contains the upstream fix that adds bodyLimit protection to prevent DoS attacks via unbounded JSON payloads. The fix was authored by upstream contributor Nathan Woltman and was present in the codebase before TuxCare onboarded it. T...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:3d5fcc9b-03b5-59af-862e-340c7338723f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 CVE-2020-8192 affects Fastify versions that use allErrors: true by default in Ajv schema validation, enabling resource exhaustion DoS attacks. The upstream Fastify project fixed this vulnerability in commit 627096fb (June 29, 2020) by setting allErrors: false as the default. This fix was already present in the upstream release v3.29.5 that TuxCare onboarded, before any TuxCare-specific work. Th...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:6ccc30df-9160-5a10-8074-358087aaf80f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 Target version 3.29.5-tuxcare.7 is NOT AFFECTED by CVE-2022-39288. The vulnerability (DoS via malicious Content-Type headers containing Object.prototype property names) was fixed upstream in commit 9a55126f on 2022-10-10 by changing customParsers from a plain object {} to a Map(). This fix shipped in upstream v3.29.5 (released 2023-01-21), which is the base of the current target. The vulnerable...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:0bd719df-1690-595b-bd70-227c46a32d7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 CVE-2022-41919 affects Fastify versions before 3.29.4 (and 4.x before 4.10.2), allowing content-type spoofing to bypass CORS pre-flight checks. The vulnerability enabled attackers to use \"simple\" Content-Types (application/x-www-form-urlencoded, multipart/form-data, text/plain) to invoke routes expecting application/json, bypassing CSRF protections.", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:68f66379-7ac2-5e07-883a-1779c83e30a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32442 does not affect version 3.29.5-tuxcare.6 of fastify. Version 3.29.5 is NOT AFFECTED by CVE-2025-32442. The vulnerability exploits content-type-specific schema validation, a feature that was introduced in version 4.29.0 (commit cd12047a, July 2024). Version 3.29.5 predates this feature entirely\u2014the vulnerable code path (content-type header normalization for schema selection) does not exist in this version. The CVE version range (4.29.0, 5.0.0-5.3.0) accurately reflects when the vulnerable feature was present.", "justification": "code_not_present" } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:6a474b2b-6ebe-5514-ba95-8f1de0431bf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:b6d049b9-2e76-5abf-911c-79f2aa2cbc0a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120216 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 Target version 3.29.5 is not affected by CVE-2026-120216. The vulnerability requires the handlerTimeout feature, which was introduced in fastify v5.8.0 (commit f376f608, February 2026). Version 3.29.5 predates this feature introduction by multiple major versions and does not contain any handlerTimeout code. The configuration validator schema confirms that only connectionTimeout, requestTimeout,...", "justification": "code_not_present" } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:67aaffa0-6f3e-55c4-8b92-7e15c5ab81c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16732 affects version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:15fa85f4-26f2-59e6-8717-5d2efe44353c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18504 is fixed in version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:8686ba00-b6df-59f9-919f-55ff704efa66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25223 is fixed in version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:cb6dcb30-68b7-5274-9387-46dfa6db12f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25224 is fixed in version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:bf1a232b-ab7f-578c-a370-e508e126179a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33806 does not affect version 3.29.5-tuxcare.6 of fastify. The target repository (Fastify 3.29.5-tuxcare.3) is not affected by CVE-2026-33806. This vulnerability exists only in Fastify v5.x and requires the `schema.body.content` per-content-type validation feature and the `getEssenceMediaType()` function, both of which were introduced in v5.x. Version 3.29.5 uses a simpler body validation mechanism that directly compiles `schema.body` without any content-type-based schema selection, making the vulnerable code path unreachable.", "justification": "code_not_present" } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:dc242c16-489d-54a9-95ef-8cd7d15bec29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3419 affects version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:71cb06f2-00ea-5de4-ab80-03e7317724b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3635 is fixed in version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:18444240-f836-55f1-b425-83e58bf2f7ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 3.29.5-tuxcare.6 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:7c66eb5b-0894-59b0-9745-d8ce1ff9efe9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 3.29.5-tuxcare.6 of fastify, and is fixed in 3.29.5-tuxcare.7." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:f9cca950-23ee-59c7-a62a-39e491222a05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 3.29.5-tuxcare.6 of fastify, and is fixed in 3.29.5-tuxcare.7." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:c5d9e4eb-b698-530c-aa6c-889a72cae243", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84504 does not affect version 3.29.5-tuxcare.6 of fastify. not_affected \u2014 Fastify 3.29.5 does not support async validation. CVE-2026-84504 requires routes using `$async` request schemas to trigger the vulnerable unwrapping behavior. The async validation feature (commit a649133e) was added after version 3.x and is not present in this release. While the `{ value, error }` unwrapping code exists at validation.js:84-85, it only applies to synchronous custom validators (J...", "justification": "code_not_present" } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ], "bom-ref": "urn:uuid:d7a1b0fe-2a1c-5c94-869c-2a238dda4c90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92081 affects version 3.29.5-tuxcare.6 of fastify, and is fixed in 3.29.5-tuxcare.8." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@3.29.5-tuxcare.6" } ] }