fastify@4.9.2 vulnerabilities

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the validate() function, which does not sufficiently validate the content of messages with content-type-specifying headers. An attacker can bypass validation by providing a malformed content-type, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the content element of the structure below.

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

Upgrade fastify to version 4.29.1, 5.3.2 or higher.