Vulnerability · Published Nov 8, 2022 · Assigned by GitHub_M
CVE-2022-39386fastify-websocket vulnerable to uncaught exception via crash on malformed packet
High 7.5
In plain English
A high-severity security flaw in fastify-websocket from fastify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @fastify/websocket | 5.0.1 | GHSA-4pcg-wr6c-h9cq |
| npm | @fastify/websocket | 7.1.1 | GHSA-4pcg-wr6c-h9cq |
| npm | fastify-websocket | no fix listed | GHSA-4pcg-wr6c-h9cq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fastify | fastify-websocket | >= 5.0.0, < 5.0.1>= 6.0.0, < 7.1.1<= 4.3.0 |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H