Vulnerability · Published Nov 22, 2022 · Assigned by GitHub_M
CVE-2022-41919Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type
Medium 4.2
In plain English
A medium-severity cross-site request forgery in fastify from fastify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | fastify | 4.10.2 | GHSA-3fjj-p79j-c9hh |
| npm | fastify | 3.29.4 | GHSA-3fjj-p79j-c9hh |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N