Cross-site Request Forgery (CSRF) Affecting fastify package, versions >=3.0.0 <3.29.4>=4.0.0 <4.10.2


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-FASTIFY-3136527
  • published22 Nov 2022
  • disclosed21 Nov 2022
  • creditUnknown

Introduced: 21 Nov 2022

CVE-2022-41919  (opens in a new tab)
CWE-352  (opens in a new tab)

How to fix?

Upgrade fastify to version 3.29.4, 4.10.2 or higher.

Overview

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). An attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

References

CVSS Scores

version 3.1