Skip to contentFastify vulnerabilities
Newest
- fastify session@fastify/session reuses destroyed session cookieCVE-2024-35220Fix available7.4 High
- fastify fastify-secure-session@fastify/secure-session: Reuse of destroyed secure session cookieCVE-2024-31999Fix available7.4 High
- fastify sessionSession 1.17.5 - LFR via chat attachmentCVE-2024-20455.5 Medium
- fastify fastify-swagger-ui, smartbear swagger ui +1 moreDefault swagger-ui configuration exposes all files in the moduleCVE-2024-22207Fix available5.3 Medium
- fastify fastify-reply-from, reply-from +1 more@fastify-reply-from JSON Content-Type parsing confusionCVE-2023-51701Fix available5.3 Medium
- fastify oauth2, npm @fastify/oauth2 +1 more@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 stateCVE-2023-31999Fix available8.8 High
- fastify fastify-passport, passport +1 moreCross site request forgery token fixation in fastify-passportCVE-2023-29020Fix available6.5 Medium
- fastify fastify-passport, passport +1 moreSession fixation in fastify-passportCVE-2023-29019Fix available8.1 High
- fastify csrf-protectionBypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protectionCVE-2023-27495Fix available5.3 Medium
- fastify fastify-multipart@fastify/multipart vulnerable to DoS due to unlimited number of partsCVE-2023-25576Fix available7.5 High
- @clerk fastifyFastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content typeCVE-2022-41919Fix available4.2 Medium
- fastify fastify-websocket, websocket +1 morefastify-websocket vulnerable to uncaught exception via crash on malformed packetCVE-2022-39386Fix available7.5 High
- @clerk fastifyDenial of service in Fastify via Content-Type headerCVE-2022-39288Fix availableEPSS 59.2%7.5 High
- fastify bearer-auth, fastify-bearer-auth +1 morePotential Timing Attack Vector in @fastify/bearer-authCVE-2022-31142Fix available7.5 High
- fastify sessionSession 1.13.0 allows an attacker with physical access to the victim's device to bypass the...CVE-2022-19554.6 Medium
- fastify github-action-merge-dependabot, github action merge dependabot +1 moreNo verification of commits origin in github-action-merge-dependabotCVE-2022-292206.5 Medium
- fastify fastify-multipartDenial of Service (DoS)CVE-2021-23597Fix available7.5 High
- fastify fastify-staticDOS and Open Redirect with user inputCVE-2021-22964Fix available8.8 High
- fastify fastify-staticURL Redirection to Untrusted Site ('Open Redirect') in fastify-staticCVE-2021-22963Fix available6.1 Medium
- fastify fastify-csrfLack of protection against cookie tossing attacks in fastify-csrfCVE-2021-29624Fix available6.5 Medium
- fastify fastify-reply-fromPrefix escapeCVE-2021-21321Fix available10.0 Critical
- fastify fastify-http-proxyPrefix escapeCVE-2021-21322Fix available10.0 Critical
- fastify fastify-csrfCross-site Request Forgery (CSRF)CVE-2020-28482Fix available5.9 Medium
- @clerk fastifyDenial of service in fastifyCVE-2020-8192Fix available6.5 Medium
- fastify fastify-multipartUncontrolled Resource Consumption in fastify-multipartCVE-2020-8136Fix available7.5 High
- fastify, hackerone fastify node module +1 moreDenial of Service vulnerability with large JSON payloads in fastifyCVE-2018-3711Fix available7.5 High