mcollina

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/static vulnerable to path traversal in directory listing

@fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes