CVE-2022-31142

The CVE-2022-31142 issue affects the Fastify bearer-auth plugin. Vulnerable releases are @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1, where crypto.timingSafeEqual is not used securely, enabling a potential timing-based length deduction attack on bearer tokens (RFC 6750 token has base64...

CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

fastify-bearer-auth (6.3.0-rc.1) potentially affected by CVE-2022-31142 via @fastify/bearer-auth (7.0.0-rc.1)

@fastify/bearer-auth NPM version 7.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/bearer-auth and may be impacted: - fastify-bearer-auth 6.3.0-rc.1 Source cves: CVE-2022-31142 Source advisory: MEND:CVE-2022-31142...

CVE-2022-31142

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

PT-2022-20560

Name of the Vulnerable Software and Affected Versions @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1 fastify-bearer-auth versions 5.0.1 through 6.0.3 Description The issue is related to the insecure use of crypto.timingSafeEqual in @fastify/bearer-auth, allowing a malicious attacker to...

CVE-2022-31142: Observable Timing Discrepancy

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

Fastify security vulnerabilities

Fastify is an open source web framework for Node.js from the Openjs Foundation. A security vulnerability exists in the Fastify plugin @fastify/bearer-auth versions prior to 7.0.2 and prior to 8.0.1, which stems from the unsafe use of crypto.timingSafeEqual...

Denial Of Service (DoS)

fastify-multipart is vulnerable to denial of service. An attacker is able to exploit the vulnerability and crash the system by providing a maliciously crafted request to the remote server via the constructor property...

GHSA-QH73-QC3P-RJV2 Uncaught Exception in fastify-multipart

Impact This is a bypass of CVE-2020-8136 https://vulners.com/cve/CVE-2020-8136. By providing a name=constructor property it is still possible to crash the application. The original fix only checks for the key proto https://github.com/fastify/fastify-multipart/pull/116. All users are recommended t...

@wmfs/tymly-fastify-plugin (>=1.57.0, <=1.59.0), homebridge-config-ui-x (>=4.41.4-test.3, <=4.43.0-test.2) potentially affected by CVE-2021-23597 via fastify-multipart (>=5.2.1, <=5.3.0)

fastify-multipart NPM version =5.2.1, =1.57.0, =4.41.4-test.3, =4.43.0-test.2 Source cves: CVE-2021-23597 Source advisory: GHSA-QH73-QC3P-RJV2...

@wmfs/tymly-fastify-plugin (>=1.57.0, <=1.59.0), homebridge-config-ui-x (>=4.41.4-test.3, <=4.43.0-test.2) potentially affected by CVE-2021-23597 via fastify-multipart (>=5.2.1, <=5.3.0)

fastify-multipart NPM version =5.2.1, =1.57.0, =4.41.4-test.3, =4.43.0-test.2 Source cves: CVE-2021-23597 Source advisory: OSV:GHSA-QH73-QC3P-RJV2...

Uncaught Exception in fastify-multipart

Impact This is a bypass of CVE-2020-8136 https://vulners.com/cve/CVE-2020-8136. By providing a name=constructor property it is still possible to crash the application. The original fix only checks for the key proto https://github.com/fastify/fastify-multipart/pull/116. All users are recommended t...

CVE-2021-23597

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...

CVE-2021-23597

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...

CVE-2021-23597 Denial of Service (DoS)

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...

CVE-2021-23597

CVE-2021-23597 affects the npm package fastify-multipart prior to 5.3.1. By supplying a name=constructor property, an attacker can crash the application, bypassing the prior CVE-2020-8136 fix. Several sources (OSV, GHSA advisories, CNNVD) confirm the vulnerability and identify upgrading to v5.3.1...

CVE-2021-23597

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...

@adminjs/fastify (>=1.0.0, <=2.0.0), @autotelic/apollo-server-fastify (>=4.0.0, <=4.1.1) +46 more potentially affected by CVE-2021-23597 via fastify-multipart (>=0.2.0, <=5.3.0)

fastify-multipart NPM version =0.2.0, =1.0.0, =4.0.0, =0.0.1, =1.0.0, =1.0.2, =1.1.7, =1.1.7, =0.0.1, =0.0.1-rc10, =0.0.3, =0.0.5, =0.0.0, =0.0.1, =1.0.0, =1.0.1 and more Source cves: CVE-2021-23597 Source advisory: MEND:CVE-2021-23597...