Findings

Across all targets, most severe first.

Severity	Title	Target	File	Triage
low	Unauthenticated /stats endpoint exposes expvar statistics requestHandler	swesweep-fasthttp	examples/fileserver/fileserver.go	–
low	Directory index generation enabled by default can leak file names main	swesweep-fasthttp	examples/fileserver/fileserver.go	–
low	Zstd encoder write errors are ignored on fast-path compression WriteZstdLevel	swesweep-fasthttp	zstd.go	–
low	Missing io.Writer validation can panic with nil or typed-nil writers WriteZstdLevel/WriteUnzstd	swesweep-fasthttp	zstd.go	–
low	Data race on stopCh and workerChanPool.New during concurrent lifecycle calls Start / Stop	swesweep-fasthttp	workerpool.go	–
low	Stop does not interrupt busy workers Stop	swesweep-fasthttp	workerpool.go	–
low	Stop/Start lifecycle leaves mustStop and workersCount stale Start / Stop	swesweep-fasthttp	workerpool.go	–
low	Unchecked nil WorkerFunc, connState, and Logger callbacks workerFunc	swesweep-fasthttp	workerpool.go	–
low	Unbounded user-value storage and linear lookup Set()	swesweep-fasthttp	userdata.go	–
low	Replacing or clearing a Closer user value without closing it Set()	swesweep-fasthttp	userdata.go	–
low	Windows drive-path heuristic can bypass leading-slash normalization addLeadingSlash	swesweep-fasthttp	uri_windows.go	–
low	Invalid certificate PEM is returned when x509.CreateCertificate fails GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	Expensive RSA-2048 key generation on every call is a DoS surface GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	Unvalidated host input allows unbounded certificate material and nonconforming SANs GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	AcquireTimer does not validate timeout duration AcquireTimer	swesweep-fasthttp	timer.go	–
low	initTimer can panic if a pooled timer is still active initTimer	swesweep-fasthttp	timer.go	–
low	Unchecked interface type assertion in AcquireTimer AcquireTimer	swesweep-fasthttp	timer.go	–
low	TOCTOU race in getTCPAddrs causes redundant resolution and orphaned cache entries getTCPAddrs	swesweep-fasthttp	tcpdialer.go	–
low	Background DNS cache cleaner goroutine never terminates (goroutine leak) tcpAddrsClean	swesweep-fasthttp	tcpdialer.go	–
low	Unchecked accumulation in totalBytesRead can overflow length accounting requestStream.Read	swesweep-fasthttp	streaming.go	–
low	int64 to int truncation of prefetched buffer size requestStream.Read	swesweep-fasthttp	streaming.go	–
low	Resource leak (br/bw/ctx) on handler panic in serveConn Server.serveConn	swesweep-fasthttp	server.go	–
low	Nil handler in ServeConn causes panic on first request ServeConn (package-level)	swesweep-fasthttp	server.go	–
low	Concurrency slot leak when handler panics in TimeoutWithCodeHandler TimeoutWithCodeHandler	swesweep-fasthttp	server.go	–
low	Abandoned reader can leave stream writer blocked indefinitely NewStreamReader	swesweep-fasthttp	stream.go	–
low	Valid IPv4-embedded IPv6 addresses with '::' immediately before the IPv4 tail are rejected validateIPv6Literal	swesweep-fasthttp	ipv6.go	–
low	Exported field mutation can race with AddClient and Do LBClient.AddClient	swesweep-fasthttp	lbclient.go	–
low	RemoveClients accepts nil callback and panics without releasing lock LBClient.RemoveClients	swesweep-fasthttp	lbclient.go	–
low	Panic on negative int in writeHexInt / AppendUint (DoS if reachable) writeHexInt, AppendUint	swesweep-fasthttp	bytesconv.go	–
low	ParseUfloat checks negative value before parse error ParseUfloat	swesweep-fasthttp	bytesconv.go	–
low	Unbounded growth of global filesLockMap sync.Map getFileLock / compressAndOpenFSFile	swesweep-fasthttp	fs.go	–
low	Unbounded trailer accumulation via direct AddTrailerBytes calls AddTrailerBytes	swesweep-fasthttp	header.go	–
low	VisitHeaderParams passes unvalidated bytes through escape handling VisitHeaderParams	swesweep-fasthttp	header.go	–
low	Quote-unaware cookie scanner truncates values cookieScanner.next/nextRaw	swesweep-fasthttp	cookie.go	–
low	Parsed SameSite and Partitioned attributes bypass safety invariants Cookie.ParseBytes	swesweep-fasthttp	cookie.go	–
low	Max-Age integer wrap can alter cookie lifetime Cookie.ParseBytes	swesweep-fasthttp	cookie.go	–
low	Ignored error on fallback compression writer creation can yield nil writer acquireRealGzipWriter / acquireRealDeflateWriter	swesweep-fasthttp	compress.go	–
low	WriteGzipLevel / WriteDeflateLevel return input length instead of compressed byte count for non-blocking writers WriteGzipLevel / WriteDeflateLevel	swesweep-fasthttp	compress.go	–
low	AddMissingPort fails to append default port for unbracketed IPv6 literals AddMissingPort	swesweep-fasthttp	client.go	–
low	Possible index-out-of-range panic in b2s for empty byte slices AddBytesKV / SetBytesKV / DelBytes / PeekMultiBytes (via b2s)	swesweep-fasthttp	args.go	–
low	Algorithmic-complexity DoS in Args.Del/DelBytes (O(n^2) delAllArgsStable) delAllArgsStable / Del / DelBytes	swesweep-fasthttp	args.go	–
low	WriteBrotliLevel returns uncompressed input length instead of compressed byte count for non-blocking writers WriteBrotliLevel	swesweep-fasthttp	brotli.go	–
low	Quadratic copy cost when deleting many duplicate query args Args.Del	swesweep-fasthttp	args.go	–
low	Stale key/value slices retained after Reset, ReleaseArgs, and Del Args.Reset	swesweep-fasthttp	args.go	–
low	Nil io.Writer causes panic in WriteBrotliLevel default branch WriteBrotliLevel	swesweep-fasthttp	brotli.go	–