Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fastify/fast-json-stringify

              main @ b926f53
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Code Injection: 2 prior fixes. Scrutinize any change in this area.

index.js: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Two critical fixes addressed the same sink (new Function) where schema keys and type values were concatenated into generated code, allowing arbitrary code execution via crafted schema property names. The pattern of unsafe string interpolation in code generation is the project's dominant historical risk and remains the highest-priority concern for any new code-generation logic.