mcollina

fast-uri vulnerable to host confusion via backslash authority introducer

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

fast-uri vulnerable to host confusion via literal backslash authority delimiter

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici vulnerable to CRLF Injection via blob-like body 'type' property