fastify 3.14.2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the fastify package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Interpretation Conflict fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Interpretation Conflict via the `Content-Type` header processing. An attacker can bypass body validation by appending a tab character (`\t`) and arbitrary content to the `Content-Type` header, causing the server to treat the body as the intended type without enforcing validation rules. Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. How to fix Interpretation Conflict? Upgrade `fastify` to version 5.7.2 or higher.	<5.7.2
M Allocation of Resources Without Limits or Throttling fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `sendWebStream` function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes. Note: Only applications that return a `ReadableStream` (or `Response` with a `Web Stream` body) via `reply.send()` are impacted How to fix Allocation of Resources Without Limits or Throttling? Upgrade `fastify` to version 5.7.3 or higher.	<5.7.3
M Cross-site Request Forgery (CSRF) fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. How to fix Cross-site Request Forgery (CSRF)? Upgrade `fastify` to version 3.29.4, 4.10.2 or higher.	>=3.0.0 <3.29.4>=4.0.0 <4.10.2

Vulnerability

Vulnerable Version

Interpretation Conflict

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict via the Content-Type header processing. An attacker can bypass body validation by appending a tab character (\t) and arbitrary content to the Content-Type header, causing the server to treat the body as the intended type without enforcing validation rules.

Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints.

How to fix Interpretation Conflict?

Upgrade fastify to version 5.7.2 or higher.

<5.7.2

Allocation of Resources Without Limits or Throttling

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the sendWebStream function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes.

Note: Only applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade fastify to version 5.7.3 or higher.

<5.7.3

Cross-site Request Forgery (CSRF)

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastify to version 3.29.4, 4.10.2 or higher.

>=3.0.0 <3.29.4>=4.0.0 <4.10.2

fastify@3.14.2 vulnerabilities

Fast and low overhead web framework, for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically