fastapi 0.46.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the fastapi package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP `Content-Type` header when reading form data with `python-multipart`. An attacker can cause a denial of service by sending a specially crafted `Content-Type` header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `fastapi` to version 0.109.1 or higher.	[,0.109.1)
M Cross-site Request Forgery (CSRF) fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). `FastAPI` would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the `FastAPI` application. How to fix Cross-site Request Forgery (CSRF)? Upgrade `fastapi` to version 0.65.2 or higher.	[,0.65.2)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP Content-Type header when reading form data with python-multipart. An attacker can cause a denial of service by sending a specially crafted Content-Type header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade fastapi to version 0.109.1 or higher.

[,0.109.1)

Cross-site Request Forgery (CSRF)

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastapi to version 0.65.2 or higher.

[,0.65.2)

fastapi@0.46.0 vulnerabilities

FastAPI framework, high performance, easy to learn, fast to code, ready for production

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically