CVE-2021-29624
Description
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
How to fix
- fastify fastify-csrf3.1.0 or later
- fastify-csrf3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastify fastify-csrf | v < 3.1.0 | 3.1.0 |
| fastify-csrfnpm | v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.