fastify 4.9.2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the fastify package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Use of Less Trusted Source fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Use of Less Trusted Source in the `request.protocol` and `request.host` getters. An attacker can manipulate the perceived protocol and host by sending crafted `X-Forwarded-Proto` and `X-Forwarded-Host` headers after bypassing the proxy and connecting directly to the application port, potentially impacting security decisions such as HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, or host-based routing. Note: This is only exploitable if the application uses the `trustProxy` option with a restrictive trust function and relies on `request.protocol` or `request.host` for security decisions, and the attacker is able to connect directly to the application, bypassing the proxy. How to fix Use of Less Trusted Source? Upgrade `fastify` to version 5.8.3 or higher.	<5.8.3
H Interpretation Conflict fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Interpretation Conflict via the `Content-Type` header processing. An attacker can bypass body validation by appending a tab character (`\t`) and arbitrary content to the `Content-Type` header, causing the server to treat the body as the intended type without enforcing validation rules. Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. How to fix Interpretation Conflict? Upgrade `fastify` to version 5.7.2 or higher.	<5.7.2
M Allocation of Resources Without Limits or Throttling fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `sendWebStream` function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes. Note: Only applications that return a `ReadableStream` (or `Response` with a `Web Stream` body) via `reply.send()` are impacted How to fix Allocation of Resources Without Limits or Throttling? Upgrade `fastify` to version 5.7.3 or higher.	<5.7.3
H Improper Validation of Specified Type of Input fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the `validate()` function, which does not sufficiently validate the content of messages with `content-type`-specifying headers. An attacker can bypass validation by providing a malformed `content-type`, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the `content` element of the structure below. `fastify.post('/', { handler(request, reply) { reply.code(200).send(request.body) }, schema: { body: { content: { 'application/json': { schema: { type: 'object', properties: { 'foo': { type: 'string', } }, required: ['foo'] } }, } } } })` How to fix Improper Validation of Specified Type of Input? Upgrade `fastify` to version 4.29.1, 5.3.2 or higher.	>=4.9.0 <4.29.1>=5.0.0 <5.3.2
M Cross-site Request Forgery (CSRF) fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. How to fix Cross-site Request Forgery (CSRF)? Upgrade `fastify` to version 3.29.4, 4.10.2 or higher.	>=3.0.0 <3.29.4>=4.0.0 <4.10.2

Vulnerability

Vulnerable Version

Use of Less Trusted Source

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Use of Less Trusted Source in the request.protocol and request.host getters. An attacker can manipulate the perceived protocol and host by sending crafted X-Forwarded-Proto and X-Forwarded-Host headers after bypassing the proxy and connecting directly to the application port, potentially impacting security decisions such as HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, or host-based routing.

Note: This is only exploitable if the application uses the trustProxy option with a restrictive trust function and relies on request.protocol or request.host for security decisions, and the attacker is able to connect directly to the application, bypassing the proxy.

How to fix Use of Less Trusted Source?

Upgrade fastify to version 5.8.3 or higher.

<5.8.3

Interpretation Conflict

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict via the Content-Type header processing. An attacker can bypass body validation by appending a tab character (\t) and arbitrary content to the Content-Type header, causing the server to treat the body as the intended type without enforcing validation rules.

Note: This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints.

How to fix Interpretation Conflict?

Upgrade fastify to version 5.7.2 or higher.

<5.7.2

Allocation of Resources Without Limits or Throttling

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the sendWebStream function. An attacker can cause excessive memory consumption by sending a slow or non-reading client request, leading to unbounded buffering and severe performance degradation or process crashes.

Note: Only applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade fastify to version 5.7.3 or higher.

<5.7.3

Improper Validation of Specified Type of Input

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the validate() function, which does not sufficiently validate the content of messages with content-type-specifying headers. An attacker can bypass validation by providing a malformed content-type, such as by altering letter casing or adding whitespace before a semicolon. This is only exploitable if specific content types are defined in the schema for validation purposes, like in the content element of the structure below.

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

How to fix Improper Validation of Specified Type of Input?

Upgrade fastify to version 4.29.1, 5.3.2 or higher.

>=4.9.0 <4.29.1>=5.0.0 <5.3.2

Cross-site Request Forgery (CSRF)

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastify to version 3.29.4, 4.10.2 or higher.

>=3.0.0 <3.29.4>=4.0.0 <4.10.2

fastify@4.9.2 vulnerabilities

Fast and low overhead web framework, for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically