fastapi@0.61.1 vulnerabilities

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP Content-Type header when reading form data with python-multipart. An attacker can cause a denial of service by sending a specially crafted Content-Type header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests.

Upgrade fastapi to version 0.109.1 or higher.

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

Upgrade fastapi to version 0.65.2 or higher.