10 CVEs matched to Fastly by name in NVD, none on CISA's Known Exploited list.
Back to the Fastly profile · Alternatives to Fastly · CVE RSS feed
2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive…
The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In vers…
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file li…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 0 | 0 | 0 | 1 |
| 2025 | 0 | 0 | 1 | 0 | 1 | 2 |
| 2024 | 0 | 0 | 4 | 0 | 0 | 4 |
| 2023 | 0 | 0 | 0 | 1 | 0 | 1 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 |
| 2017 | 0 | 0 | 1 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2026-7220 | 2.1% | 81% |
| CVE-2017-13761 | 1.2% | 68% |
| CVE-2022-39218 | 0.9% | 60% |
| CVE-2015-10094 | 0.5% | 45% |
| CVE-2025-61584 | 0.4% | 29% |
| CVE-2024-34768 | 0.4% | 29% |
| CVE-2024-34803 | 0.3% | 19% |
| CVE-2024-38375 | 0.3% | 17% |
| CVE-2021-47185 | 0.2% | 7.0% |
| CVE-2025-58199 | 0.1% | 3.0% |
A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mcp.mjs of the component fastly_cli Tool. …
serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action i…
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mc…
Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could all…
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64…
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argum…
The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` a…
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions…