Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP `Content-Type` header when reading form data with `python-multipart`. An attacker can cause a denial of service by sending a specially crafted `Content-Type` header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `fastapi` to version 0.109.1 or higher.	[,0.109.1)
M Cross-site Request Forgery (CSRF) fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). `FastAPI` would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the `FastAPI` application. How to fix Cross-site Request Forgery (CSRF)? Upgrade `fastapi` to version 0.65.2 or higher.	[,0.65.2)

Regular Expression Denial of Service (ReDoS)

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP Content-Type header when reading form data with python-multipart. An attacker can cause a denial of service by sending a specially crafted Content-Type header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade fastapi to version 0.109.1 or higher.

[,0.109.1)

Cross-site Request Forgery (CSRF)

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade fastapi to version 0.65.2 or higher.

[,0.65.2)

Go back to all versions of this package