CVE-2022-41919
Description
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
How to fix
- fastify fastify3.29.4, 4.10.2 or later
- fastify4.10.2, 3.29.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastify fastify | 3.0.0 ≤ v < 3.29.4, 4.0.0 ≤ v < 4.10.2 | 3.29.4, 4.10.2 |
| fastifynpm | 4.0.0 ≤ v < 4.10.2, 3.0.0 ≤ v < 3.29.4 | 4.10.2, 3.29.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.