Homepage
About Snyk

fastify@3.16.1 vulnerabilities

Fast and low overhead web framework, for Node.js

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the fastify package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Request Forgery (CSRF)

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastify to version 3.29.4, 4.10.2 or higher.

>=3.0.0 <3.29.4 >=4.0.0 <4.10.2
Go back to all versions of this package