CVE-2023-29019: Session Fixation

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using @fastify/passport in affected versions for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation...

CVE-2023-27495

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

@flowforge/flowforge (>=0.9.0, <=0.10.0), schwing (>=0.2.14, <=0.2.26) potentially affected by CVE-2023-27495 via @fastify/csrf-protection (5.1.0)

@fastify/csrf-protection NPM version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/csrf-protection and may be impacted: - @flowforge/flowforge =0.9.0, =0.2.14, =0.2.26 Source cves: CVE-2023-27495 Source advisory: OSV:GHSA-QRGF-9GPC-VRX...

@flowforge/flowforge (>=0.9.0, <=0.10.0), schwing (>=0.2.14, <=0.2.26) potentially affected by CVE-2023-27495 via @fastify/csrf-protection (5.1.0)

@fastify/csrf-protection NPM version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/csrf-protection and may be impacted: - @flowforge/flowforge =0.9.0, =0.2.14, =0.2.26 Source cves: CVE-2023-27495 Source advisory: GHSA-QRGF-9GPC-VRXW...

Bypass of CSRF protection in the presence of predictable userInfo

Description The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the use...

CVE-2023-27495

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

Cross site request forgery (csrf)

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495

The CVE-2023-27495 entry concerns the @fastify/csrf-protection plugin for Fastify. A CSRF protection bypass can occur when the optional userInfo parameter is missing or its value is predictable, allowing network and same-site attackers to fixate the _csrf cookie and forge valid tokens for a user’...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

@flowforge/flowforge (>=0.9.0, <=0.10.0), schwing (>=0.2.14, <=0.2.26) potentially affected by CVE-2023-27495 via @fastify/csrf-protection (5.1.0)

@fastify/csrf-protection NPM version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/csrf-protection and may be impacted: - @flowforge/flowforge =0.9.0, =0.2.14, =0.2.26 Source cves: CVE-2023-27495 Source advisory: MEND:CVE-2023-27495...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495: Cross-Site Request Forgery (CSRF)

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

Fastify Fastify-csrf Cross-Site Request Forgery Vulnerability

Fastify Fastify-csrf is a Fastify community based on Javascript can provide CSRF protection for Fastify plugin . A cross-site request forgery vulnerability exists in Fastify Fastify-csrf. An attacker can exploit this vulnerability to bypass the cross-site request forgery protection mechanism...

GHSA-HPP2-2CR5-PF6G Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

@cromwell/cms (>=3.0.0-alpha.0, <=3.0.5), @cromwell/server (>=3.0.0-alpha.0, <=3.0.5) +4 more potentially affected by CVE-2023-25576 via @fastify/multipart (>=7.1.0, <=7.4.0)

@fastify/multipart NPM version =7.1.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.1, =2.42.0, =1.14.0, =0.50.5-test.0, =4.51.0-test.0 Source cves: CVE-2023-25576 Source advisory: OSV:GHSA-HPP2-2CR5-PF6G...

@silenteer/natsu-port-server (>=0.0.38, <=0.0.54), @wmfs/tymly-fastify-plugin (>=1.85.0, <=1.87.0) potentially affected by CVE-2023-25576 via @fastify/multipart (6.0.0)

@fastify/multipart NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/multipart and may be impacted: - @silenteer/natsu-port-server =0.0.38, =1.85.0, =1.87.0 Source cves: CVE-2023-25576 Source advisory: OSV:GHSA-HPP2-2CR5-PF6G...

@silenteer/natsu-port-server (>=0.0.38, <=0.0.54), @wmfs/tymly-fastify-plugin (>=1.85.0, <=1.87.0) potentially affected by CVE-2023-25576 via @fastify/multipart (6.0.0)

@fastify/multipart NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/multipart and may be impacted: - @silenteer/natsu-port-server =0.0.38, =1.85.0, =1.87.0 Source cves: CVE-2023-25576 Source advisory: GHSA-HPP2-2CR5-PF6G...

Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...