{"id":"CVE-2021-32677","aliases":["CLSA-2025-1754957513","DEBIAN-CVE-2021-32677","EUVD-2021-0080","GHSA-8h2j-cgx8-6xv7","PYSEC-2021-100","UBUNTU-CVE-2021-32677"],"status":"published","title":"Cross-Site Request Forgery (CSRF) in FastAPI","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00722,"percentile":0.54443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2021-06-09T17:30:12Z","modified":"2026-10-23T18:03:14Z","fixes":[{"ecosystem":"PyPI","package":"fastapi","fixed_in":["0.65.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"fastapi","fixed_in":["0.63.0.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fastapi","fixed_in":["0.70.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fastapi","fixed_in":["0.70.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fastapi","fixed_in":["0.70.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65.2"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.63.0"},{"fixed":"0.63.0.post1+tuxcare"}]}],"versions":["0.63.0"]},{"source":"osv","ecosystem":"Debian:12","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65.2"}]}],"versions":["0.1.0","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.12.1","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.2.1","0.20.0","0.20.1","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.27.2","0.28.0","0.29.0","0.29.1","0.3.0","0.30.0","0.30.1","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.38.0","0.38.1","0.39.0","0.4.0","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.44.1","0.45.0","0.46.0","0.47.0","0.47.1","0.48.0","0.49.0","0.49.1","0.49.2","0.5.0","0.5.1","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.53.2","0.54.0","0.54.1","0.54.2","0.55.0","0.55.1","0.56.0","0.56.1","0.57.0","0.58.0","0.58.1","0.59.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.60.0","0.60.1","0.60.2","0.61.0","0.61.1","0.61.2","0.62.0","0.63.0","0.64.0","0.65.0","0.65.1","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"fastapi","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"fa7e3c996edf2d5482fff8f9d890ac2390dede4d"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65.2"}]}],"versions":["0.1.0","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.12.1","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.2.1","0.20.0","0.20.1","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.27.2","0.28.0","0.29.0","0.29.1","0.3.0","0.30.0","0.30.1","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.38.0","0.38.1","0.39.0","0.4.0","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.44.1","0.45.0","0.46.0","0.47.0","0.47.1","0.48.0","0.49.0","0.49.1","0.49.2","0.5.0","0.5.1","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.53.2","0.54.0","0.54.1","0.54.2","0.55.0","0.55.1","0.56.0","0.56.1","0.57.0","0.58.0","0.58.1","0.59.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.60.0","0.60.1","0.60.2","0.61.0","0.61.1","0.61.2","0.62.0","0.63.0","0.64.0","0.65.0","0.65.1","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fastapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.63.0-2","0.63.0-2ubuntu0.1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"tiangolo","product":"fastapi"}],"references":[{"url":"https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32677","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/fastapi/PYSEC-2021-100.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8h2j-cgx8-6xv7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32677","tags":["advisory"]},{"url":"https://github.com/tiangolo/fastapi","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32677","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-32677","title":"Cross-Site Request Forgery (CSRF) in FastAPI","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T17:30:12Z","modified":"2024-08-03T23:25:31.094Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-0080","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T17:30:12Z","modified":"2024-08-03T23:25:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:36.41075Z"}],"ghsa":[{"id":"GHSA-8h2j-cgx8-6xv7","title":"Cross-Site Request Forgery (CSRF) in FastAPI","description":"### Impact\n\nFastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.\n\nIn versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).\n\nSo, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.\n\nBut requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.\n\n### Patches\n\nThis is fixed in FastAPI `0.65.2`.\n\nThe request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.\n\n### Workarounds\n\nIt's best to upgrade to the latest FastAPI.\n\nBut still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.\n\n### References\n\n* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)\n* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)\n* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)\n\n### For more information\n\nIf you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)","status":"published","published":"2021-06-10T15:43:54Z","modified":"2024-09-20T17:18:27Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-32677","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T18:15:08.553Z","modified":"2026-06-17T03:53:24.237Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"CVE-2021-32677","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T18:15:08.553Z","modified":"2026-10-20T10:50:12.717499112Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32677","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T18:15:08.553Z","modified":"2026-10-23T18:03:14.606299318Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-8h2j-cgx8-6xv7","title":"Cross-Site Request Forgery (CSRF) in FastAPI","description":"### Impact\n\nFastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.\n\nIn versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).\n\nSo, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.\n\nBut requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.\n\n### Patches\n\nThis is fixed in FastAPI `0.65.2`.\n\nThe request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.\n\n### Workarounds\n\nIt's best to upgrade to the latest FastAPI.\n\nBut still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.\n\n### References\n\n* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)\n* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)\n* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)\n\n### For more information\n\nIf you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)","status":"published","published":"2021-06-10T15:43:54Z","modified":"2026-07-08T06:28:18.55440831Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"UBUNTU-CVE-2021-32677","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T18:15:00Z","modified":"2025-09-08T16:47:10Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"CLSA-2025-1754957513","title":"TuxCare security update for fastapi (1 CVE)","description":"TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.63.0.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:48:04.88466695Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"PYSEC-2021-100","description":"FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.","status":"published","published":"2021-06-09T18:15:00Z","modified":"2023-11-08T04:05:56.616377Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}