### Impact `@fastify/static` permits a route-guard or `allowedPath` bypass when the letter case of a path segment is altered, on a case-insensitive filesystem (Windows and the default macOS volume...

### Impact `@fastify/proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. This fork of `proxy-addr` inherited the same logic as the vulnerable u...

### Impact `@fastify/auth` composes multiple authentication functions with AND/OR relations, including nested arrays (for example `fastify.auth([f1, [f2, f3]], { relation: 'or' })` meaning `f1 OR ...

### Impact `fastify` crashes with an uncaught `ERR_HTTP2_INVALID_CONNECTION_HEADERS` exception when a route that registers a response trailer via `reply.trailer()` is served over HTTP/2. Fastify...

### Impact `fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `body`) while the name is still percent-encoded, and only percent-decodes it...

### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. F...

Important Fix CVE-2026-90711 (GHSA-jqcg-44mw-7w3h) What's Changed Add OSSF scorecard action by @carpasse in #27 Fix ci pipeline and add missing Node.JS versions by @carpasse in #26 [StepSecurity...

### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address ...

### Impact moment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-string, attacker-influenced value to `moment.locale()`, a specially crafted...

### Impact Multer's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an in...

Highlights multer finally supports Google Cloud Functions and Firebase 🎉 These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty re...

What's Changed Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @baryman in #7135 feat: allow conditional revalidation for QUERY requests (v4) by @Cherry in #7377 deps: qs@~6.16.0 by @lazer...

To combat volunteer burnout driven by a surge in AI-generated vulnerability reports, the OpenJS Foundation CNA will temporarily pause all security operations from September 17 to October 6, 2026. This...

### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the...

Important Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95) What's Changed chore: add funding to package.json by @bjohansebas in #248 build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @depe...

### Impact hbs 4.3.0 can crash the Node.js process when an async helper (registered with `registerAsyncHelper`) resolves to an object whose `toHTML` property is truthy but not callable. During out...

Important Fix CVE-2026-87123 (GHSA-3c55-w9jx-p5jr) What's Changed fix: treat async substitution throws as render errors by @official-burak in #276 4.3.1 by @UlisesGascon in #277 New Contributor...

### Impact morgan writes attacker-controlled request data into the access log. The escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators and the backslash...

Important Security fix for CVE-2026-87859 (GHSA-9f6g-j8ch-79g4) What's Changed docs: fix typos across documentation by @vaibhavmashal in #378 test: run CI on Windows and macOS by @kilisamemarisa...

### Impact multiparty@4.3.0 and lower versions are vulnerable to denial of service via uncontrolled memory allocation. multiparty bounds accumulated field values (`maxFieldsSize`) and file bytes (...

### Impact `cookies` validates cookie name and value against character sets that reject `;`, but the `domain` and `path` options are checked only against a permissive RFC 7230 field-content matche...

Adds a docs/threat-model.md defining what is and is not a security vulnerability in Moment, and links it from SECURITY.md and the README Resources list. Modeled on the threat models of sibling Open...

### Impact `fastify-cli` versions from 1.5.0 through 8.0.0 select the Node Inspector host with an incorrectly grouped conditional expression. Because logical OR binds tighter than the ternary oper...

Important Same code base as 1.20.7. This was created to test the new release process. What's Changed ci: backport npm-publish workflow from master by @UlisesGascon in #769 1.20.8 by @UlisesGascon ...

### Impact undici's `RetryHandler` can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original `response.body` held...

### Impact Undici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives t...

### Impact The undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never r...

### Impact The `interceptors.decompress()` interceptor decompresses HTTP response bodies according to the untrusted `Content-Encoding` header. The number of decompression layers is capped at 5, bu...

### Impact undici's `interceptors.cache()` does not handle `Set-Cookie` in the cache path. In shared-cache mode (`type: 'shared'`, the default), a cacheable response (for example `Cache-Control: p...

### Impact undici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is abor...

### Impact undici's `BalancedPool` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-upstream `Pool`. JSON canno...

### Impact undici's `interceptors.cache()` documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set...

## Impact When `interceptors.cache()` or `interceptors.deduplicate()` is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own `origin`, undi...

## Impact undici's `WebSocketStream` crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handle...

## Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed messa...

### Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased o...

### Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean `false` as a valid schema that rejects every...

### Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` ...

### Impact Fastify runs a route's validator and, for a result shaped like `{ value, error }`, unwraps it: an `error` becomes a validation failure and `value` replaces the request part. This conven...

### Impact `@fastify/middie` versions `>= 9.1.0, <= 9.3.3` match path-scoped middleware against the raw request target, while Fastify's router (find-my-way) resolves an absolute-form target to its...

## Impact `@fastify/http-proxy` validates proxied WebSocket destinations against the `rewritePrefix` boundary, but the plain HTTP request path does not apply the same check. A path that uses backs...

> [!IMPORTANT] > CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds t...

### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such...

### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port ...

Security releases for hbs, multer, and morgan have been published. We recommend that all users upgrade as soon as possible.

Blockers We need/want to land (waiting for reviews): docs: add FormData upload examples #896 feat: expose busboy defCharset, highWaterMark and fileHwm options #1465 feat: add streamHandler opti...

### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large...

### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names ca...

### Impact When `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed. The `'limit'` event is registered inside the async `fileFilter` callback, s...