CVE-2023-25576 @fastify/multipart vulnerable to DoS due to unlimited number of parts

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...

@cromwell/cms (>=3.0.0-alpha.0, <=3.0.5), @cromwell/server (>=3.0.0-alpha.0, <=3.0.5) +4 more potentially affected by CVE-2023-25576 via @fastify/multipart (>=7.1.0, <=7.4.0)

@fastify/multipart NPM version =7.1.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.1, =2.42.0, =1.14.0, =0.50.5-test.0, =4.51.0-test.0 Source cves: CVE-2023-25576 Source advisory: MEND:CVE-2023-25576...

CVE-2023-25576 @fastify/multipart vulnerable to DoS due to unlimited number of parts

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...

CVE-2023-25576 @fastify/multipart vulnerable to DoS due to unlimited number of parts

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...

@silenteer/natsu-port-server (>=0.0.38, <=0.0.54), @wmfs/tymly-fastify-plugin (>=1.85.0, <=1.87.0) potentially affected by CVE-2023-25576 via @fastify/multipart (6.0.0)

@fastify/multipart NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/multipart and may be impacted: - @silenteer/natsu-port-server =0.0.38, =1.85.0, =1.87.0 Source cves: CVE-2023-25576 Source advisory: MEND:CVE-2023-25576...

CVE-2023-25576

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...

CVE-2023-25576

CVE-2023-25576 affects the Fastify multipart plugin (@fastify/multipart). The vulnerability is a denial-of-service caused by the multipart body parser accepting an unlimited number of parts (files, fields, or empty field parts). It is fixed by upgrading to v7.4.1 for Fastify v4.x and v6.0.1 for F...

PT-2023-20174

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 6.0.1 and 7.4.1 Description The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body pars...

CVE-2023-25576: Allocation of Resources Without Limits or Throttling

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...

Fastify-multipart security vulnerability

fastify-multipart is a package that supports parsing multiple content types. A security vulnerability exists in fastify-multipart versions prior to 6.0.1, prior to 7.0.0, and prior to 7.4.1, which originates from a multipart subject parser that accepts an unlimited number of file parts, a multipa...

GHSA-CM8H-Q92V-XCFC mercurius has Uncaught Exception when using subscriptions

Impact Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. Patches This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2. Workarounds...

mercurius has Uncaught Exception when using subscriptions

Impact Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. Patches This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2. Workarounds...

CVE-2022-41919

A Cross-site request forgery CSRF vulnerability was found in fastify due to improper handling of incorrect Content-Types. This flaw allows an attacker to use an incorrect 'Content-Type' to bypass checks to allow fetch requests that could be used to invoke routes that only accept application/json...

Code injection

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477

Summary: CVE-2023-22477 affects Mercurius (GraphQL adapter for Fastify) prior to v10.5.0. A malformed WebSocket packet sent to "/graphql" can cause a denial of service. The issue is documented in multiple sources and was patched in PR #940, with the fix released in v11.5.0 (and v8.13.2 in some br...

CVE-2023-22477

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to "/graphql". This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477: Uncaught Exception

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...