Package
postgres-meta
Component
fastify
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixed upstream: postgres-meta still depends on Fastify 4, and the fix exists only in Fastify 5. This package ships fastify 4.29.1, the final Fastify 4 release; CVE-2026-84428 is fixed in fastify 5.12.2 (https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58), and no fixed 4.x release exists because Fastify 4 reached end of life on 2025-06-30. The newest postgres-meta release, v0.100.0, and its development branch both still declare fastify ^4.24.3, and an upgrade to Fastify 5 does not build without changes to postgres-meta's own source. Waiting for the first upstream release containing the fix.
Status