Homepage

fastapi@0.46.0 vulnerabilities

FastAPI framework, high performance, easy to learn, fast to code, ready for production

  • latest version

    0.123.7

  • latest non vulnerable version

    0.123.7

  • first published

    6 years ago

  • latest version published

    2 hours ago

  • licenses detected

  • View fastapi package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the fastapi package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Regular Expression Denial of Service (ReDoS)

    fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP Content-Type header when reading form data with python-multipart. An attacker can cause a denial of service by sending a specially crafted Content-Type header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade fastapi to version 0.109.1 or higher.

    [,0.109.1)
    • M
    Cross-site Request Forgery (CSRF)

    fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

    Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

    How to fix Cross-site Request Forgery (CSRF)?

    Upgrade fastapi to version 0.65.2 or higher.

    [,0.65.2)
    Go back to all versions of this package