Low
CVE-2026-107832
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 75
Reset filters
High
CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
In affected versions of the MCP TypeScript SDK, an unauthenticated HTTP request within default size limits can exhaust server memory during validation. This allows attackers to crash the server process through denial of service.
High
CVE-2026-111770
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
Critical
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Medium
CVE-2026-74866
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Medium
CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
Medium
CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
High
CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
Medium
CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Medium
CVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Medium
CVE-2026-7120
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
High
CVE-2026-15074
@fastify/static vulnerable to route guard bypass via path traversal
High
CVE-2026-55388
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
High
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash
High
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-7768
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.