Vulnerability	Vulnerable Version
M Cross-site Request Forgery (CSRF) fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. How to fix Cross-site Request Forgery (CSRF)? Upgrade `fastify` to version 3.29.4, 4.10.2 or higher.	>=3.0.0 <3.29.4>=4.0.0 <4.10.2

Cross-site Request Forgery (CSRF)

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastify to version 3.29.4, 4.10.2 or higher.

>=3.0.0 <3.29.4>=4.0.0 <4.10.2

Go back to all versions of this package