{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a74bcafd-c237-56a6-bf93-94c26101e0bc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.12.5", "type": "library", "bom-ref": "pkg:npm/fastify@5.12.5", "version": "5.12.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:8c66d49c-119b-5f1b-9472-fc036292922a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 5.12.5 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in fastify when processing large JSON payloads. The target version 5.12.5 is NOT vulnerable. The upstream fix for this CVE was introduced in fastify v0.38.0 (commit fabd2a01 by Nathan Woltman) and has been present in all subsequent releases. The target contains comprehensive bodyLimit defenses: a default 1MB limit on request bodies, early Content-Leng...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:95be4e62-95a2-5072-9de8-11bbe93717c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 5.12.5 of fastify. not_affected \u2014 Fastify v5.12.5 is not affected by CVE-2020-8192. The vulnerability, which allowed DoS attacks via resource exhaustion when `allErrors: true` was used with specially crafted schemas, was fixed in upstream Fastify v2.15.0 (June 2020) by setting `allErrors: false` as the default configuration. This fix is present in v5.12.5, which was released much later and already includes the protection. The d...", "justification": "protected_at_runtime" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:b3e65eba-c9ec-59fa-ba9e-11cbfbca8691", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 5.12.5 of fastify. not_affected \u2014 CVE-2022-39288 (Content-Type header spoofing DoS) is NOT present in target version 5.12.5. The vulnerability affected Fastify v4.x before v4.8.0 and relied on naive string matching (indexOf) to select content-type parsers. An attacker could send 'Content-Type: text/plain; content-type=\"application/json\"' causing parser confusion and crashes. The target contains upstream commit 32d7b6ad (Jan 202...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:b21f6e3b-f561-5dca-aafa-d5fbacb49958", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 5.12.5 of fastify. not_affected \u2014 Fastify 5.12.5 is not affected by CVE-2022-41919. The vulnerability\u2014allowing Content-Type spoofing to bypass CORS preflight checks\u2014was fixed in upstream version 4.10.2 (November 2022) by commit 62dde76f. This fix was carried forward to all subsequent versions including the 5.x series. The target version 5.12.5 inherited the fix from the upstream release, not from a TuxCare backport. The fix ens...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:009da045-0c5c-5b04-8b97-9cb976a4ad01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:547de2f7-2534-5335-9376-9a1b7eaad0f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.12.5 of fastify, and is fixed in 5.12.5-tuxcare.1." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:6935f320-5bc8-5f1a-89b5-3c368581a6dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.12.5 of fastify, and is fixed in 5.12.5-tuxcare.1." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:6e90f1c1-425f-5465-b3d3-6e0ffa8742f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-16732 does not affect version 5.12.5 of fastify. not_affected \u2014 CVE-2026-16732 (bypass of CVE-2026-3635 fix for numeric trustProxy hop-count validation) is not present in fastify 5.12.5. The upstream fix from commit 8acfea7e was already shipped in this version before TuxCare maintenance began. The fix disables numeric trustProxy by making it always return false, and removes 'number' from the TypeScript type union. Both runtime code (lib/request.js) and type...", "justification": "code_not_present" } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:cf943ace-b9c8-55bf-a44a-6e1520594c0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-18504 does not affect version 5.12.5 of fastify. not_affected \u2014 The target fastify repository (version 5.12.5 at SHA 08334d60) is NOT affected by CVE-2026-18504. The vulnerability pattern is absent because the upstream fix (commit 1ef8a60c authored by Matteo Collina) shipped in fastify 5.12.1 and is present in the target code. The fix modifies lib/validation.js to provide parent object context to Ajv validators, enabling in-place mutation of root primitive ...", "justification": "code_not_present" } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:9d31ba09-4ac9-5139-a78c-a72309efa15f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25223 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:15cd5a02-7040-5651-9c11-859cbeb3e574", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.12.5 of fastify. not_affected \u2014 Target Fastify 5.12.5 is not affected by CVE-2026-25224 (DoS via unbounded buffering in Web Streams). The vulnerability requires missing backpressure handling in sendWebStream(), but the fix (waitingDrain flag, respecting res.write() return value, drain event handling) is already present in lib/reply.js:765-820. The fix was introduced by upstream commit eb111563 (v5.7.3, Feb 2026) authored by M...", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:78013ffb-de00-5a72-aba6-7ed2c6553228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:1d8fdd5e-a750-5cf0-aa57-1b5753e6aeb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 5.12.5 of fastify. not_affected \u2014 Target Fastify v5.12.5 does not contain CVE-2026-3419. The vulnerability (missing `$` regex anchor in Content-Type subtype validation, allowing RFC-invalid headers with trailing garbage like \"application/json garbage\" to pass validation and be processed) was fixed in upstream commit 67f6c9b32cb3623d3c9470cc17ed830dd2f083d7 by James Sumners (GitHub). This commit was already present in the upstre...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:993d4007-3488-5610-8fdc-37a8a4f1b9fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.12.5 of fastify. not_affected \u2014 Target Fastify 5.12.5 is not affected by CVE-2026-3635. The vulnerability (reading X-Forwarded-Host and X-Forwarded-Proto headers from untrusted connections when trustProxy is restrictively configured) was fixed in upstream commits 4e1db5bd, 8dee9be0, and 8acfea7e, all authored by upstream Fastify maintainers. These fixes were already present in the Fastify 5.12.5 release before TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:60976930-b498-5f49-a7d1-294c6d499b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:b3b0cbe9-cc9c-5112-a767-eb426e3f7084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:3f50c646-21aa-574d-81c6-5aaf3defa922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:cadfa572-4eb5-54bb-91d4-aceb711e8099", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84504 affects version 5.12.5 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.12.5" } ], "bom-ref": "urn:uuid:bed5383f-2528-549a-8b0c-29ee3c4d33c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-92081 does not affect version 5.12.5 of fastify. not_affected \u2014 The target repository (fastify 5.12.5) is NOT AFFECTED by CVE-2026-92081. The upstream vendor fix by Matteo Collina (commit ad06a4c3f) was already present in the v5.12.5 release before TuxCare maintenance began. The fix adds a protocol version check to skip setting 'Transfer-Encoding: chunked' for HTTP/2 responses where it's forbidden, preventing the ERR_HTTP2_INVALID_CONNECTION_HEADERS excepti...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.12.5" } ] }