{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:51114fbf-fe66-56b0-b950-5f5bd9894d91", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.4-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/fastify@5.12.4-tuxcare.2", "version": "5.12.4-tuxcare.2", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.4", "type": "library", "version": "5.12.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:e6536379-95df-53f5-9dbc-1d77212024b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 The target fastify version 5.12.4-tuxcare.1 is NOT affected by CVE-2018-3711. The vulnerability was fixed in fastify v0.38.0 (January 2018) by introducing a bodyLimit option with a default of 1 MB to prevent denial of service from large JSON payloads. The target version (5.12.4) is approximately 137 major versions ahead of the fix version and contains the upstream vendor's defense mechanism: a ...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:bcfa3e70-3875-542d-9be5-f91ebeb00260", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 CVE-2020-8192 is NOT present in Fastify v5.12.4-tuxcare.1. The vulnerability was a DoS attack vector when the AJV `allErrors: true` option was enabled, allowing malicious schemas to trigger resource exhaustion. The upstream Fastify team fixed this on June 29, 2020 (commit 627096fb) by explicitly setting `allErrors: false` as the default configuration. This fix was already present in the upstrea...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:dd9e2c11-e55e-5567-bebb-afc57d047300", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 CVE-2022-39288 affects fastify v4.x (before v4.8.0) where malicious Content-Type headers containing Object.prototype property names could cause application crashes via content-type spoofing. The target version (5.12.4-tuxcare.1) is NOT affected because it uses a proper ContentType parser class that separates media type from parameters, preventing the spoofing attack. The fix was introduced in u...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:f8712567-2b5e-5811-bdfb-ad38799064fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 Fastify 5.12.4 is not affected by CVE-2022-41919. The vulnerability was fixed in upstream Fastify in November 2022 (versions 3.29.4/4.10.2), well before the 5.x series was released. The fix commit (62dde76f1f7aca76e38625fe8d983761f26e6fc9) is an ancestor of Fastify 5.0.0 (released September 2024) and all subsequent versions including 5.12.4. The vulnerable Content-Type spoofing pattern is not p...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:091fb98f-32aa-57d9-bf54-7ee3ea5a68d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:dd255523-cf6f-5651-afe6-7a272f87d326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107832 is fixed in version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:d05f8f84-9013-5adf-807c-00090c4aa9c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-120216 is fixed in version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:27a559f4-08a9-5e1c-942e-266f1b7584a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-16732 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 The target fastify 5.12.4-tuxcare.1 is NOT vulnerable to CVE-2026-16732. The vulnerability (incomplete fix for CVE-2026-3635 affecting numeric trustProxy configuration) was fixed in upstream fastify v5.12.1 by commit 8acfea7e. The target version 5.12.4 is based on upstream v5.12.4 which already includes this fix. The vulnerable pattern (numeric trustProxy predicate `function (a, i) { return i <...", "justification": "code_not_present" } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:baaa54f2-ee6e-55e1-ab5f-2aadde728d4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-18504 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-18504 is not present in fastify 5.12.4-tuxcare.1. The vulnerability (root primitive body values validated after type coercion but exposed to handlers in their original uncoerced form, bypassing schema constraints) was fixed by upstream author Matteo Collina in commit 1ef8a60c87e94f42f666aa15ad68957772a83655, which shipped in upstream release v5.12.1. The target version 5.12.4 includes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:85bd31ea-882d-5bdc-a8cc-57064883fbec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25223 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:c8bfa434-c77b-5d81-bc39-9aad9abac1e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-25224 (Web Streams backpressure DoS) is not present in Fastify 5.12.4. The fix was applied by upstream maintainer Matteo Collina in commit eb11156396f6a5fedaceed0140aed2b7f026be37, shipped in Fastify 5.7.3, and was already included in the 5.12.4 release before TuxCare onboarding. The target code at lib/reply.js:805-820 correctly honors backpressure by checking res.write() return values...", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:f6a55498-5c70-5a4e-a2dd-d621804a2908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:c83dfcde-0593-5de8-ad86-eb24f6fe3fe0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 CVE-2026-3419: Fastify version 5.12.4 is NOT AFFECTED. The vulnerability (accepting malformed Content-Type headers with trailing garbage) was fixed in upstream commit 67f6c9b3 by adding a terminating anchor ($) to the subtypeNameReg regex. This fix was already present in the upstream Fastify 5.12.4 release that TuxCare onboarded, before any TuxCare backport work began on this version branch. Th...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:e89f66b7-910f-5cd1-bf19-c5b32ce50994", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.12.4-tuxcare.2 of fastify. not_affected \u2014 The target fastify 5.12.4 is not affected by CVE-2026-3635. The vulnerability (forwarded headers X-Forwarded-Host and X-Forwarded-Proto trusted from any connection regardless of trustProxy configuration) was fixed in upstream commit 4e1db5bd (March 2026) by gating header reads on the trustProxy function. This fix was already present in the fastify 5.12.4 release before TuxCare onboarded it. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:86457f30-d1ae-513a-b257-15bbe2d26ba0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:05550371-60fb-5517-8a6d-c6145837dcc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:170dac9f-2999-53a7-bee3-1f944fcb3ad2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:512a18b8-fe73-558a-aaec-3287efa69939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84504 affects version 5.12.4-tuxcare.2 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ], "bom-ref": "urn:uuid:ffca8f66-8313-53c5-b215-248485d1bcd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92081 is fixed in version 5.12.4-tuxcare.2 of fastify." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.12.4-tuxcare.2" } ] }