mcollina

@fastify/static vulnerable to route guard bypass via path case-folding

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici vulnerable to downstream response splitting via retry interceptor

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization