@wmfs/tymly-fastify-plugin (>=1.50.0, <=1.51.0), egg-bag (>=1.44.43, <=1.45.11) potentially affected by CVE-2021-22964 via fastify-static (>=4.2.4, <=4.4.0)

fastify-static NPM version =4.2.4, =1.50.0, =1.44.43, =1.45.11 Source cves: CVE-2021-22964 Source advisory: OSV:GHSA-PGH6-M65R-2RHQ...

DOS and Open Redirect with user input

Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e. A DOS vulnerability is possible if the URL contains inval...

Fastify: 1-click DOS in fastify-static via directly passing user's input to new URL() of NodeJS without try/catch

Summary: When fastify-static is mounted at root and registered the option redirect: true default of redirect option is false, the following line directly feed user's input which is req.raw.url to URL API without try/catch: https://github.com/fastify/fastify-static/blob/master/index.jsL439. A remo...

PT-2021-4674

Name of the Vulnerable Software and Affected Versions fastify-static versions 4.2.4 through 4.4.0 Description A redirect issue in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain. For example,...

URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set...

@cromwell/admin-panel (>=1.1.3, <=2.1.8), @cromwell/cms (>=1.1.7, <=2.1.12) +5 more potentially affected by CVE-2021-22963 via fastify-static (>=4.0.1, <=4.2.3)

fastify-static NPM version =4.0.1, =1.1.3, =1.1.7, =1.31.0, =1.39.28, =4.41.2-test.1, =3.4.0, =3.6.0-beta.3 Source cves: CVE-2021-22963 Source advisory: GHSA-P6VG-P826-QP3V...

@cromwell/admin-panel (>=1.1.3, <=2.1.8), @cromwell/cms (>=1.1.7, <=2.1.12) +5 more potentially affected by CVE-2021-22963 via fastify-static (>=4.0.1, <=4.2.3)

fastify-static NPM version =4.0.1, =1.1.3, =1.1.7, =1.31.0, =1.39.28, =4.41.2-test.1, =3.4.0, =3.6.0-beta.3 Source cves: CVE-2021-22963 Source advisory: OSV:GHSA-P6VG-P826-QP3V...

GHSA-P6VG-P826-QP3V URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set...

PT-2021-15300

Name of the Vulnerable Software and Affected Versions fastify-static versions prior to 4.2.4 Description A redirect issue in the fastify-static module allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain. The issue affects fastify-static...

Fastify: Open redirect in fastify-static via mishandled user's input when attempt to redirect

Summary: When fastify-static is mounted at root and the register option redirect: true, the following 2 lines cause open redirect bug: https://github.com/fastify/fastify-static/blob/master/index.jsL156-L157. A remote attackers can redirect users to arbitrary web sites via a double forward slash:...

CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

Cross site request forgery (csrf)

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624 Lack of protection against cookie tossing attacks in fastify-csrf

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

@nodosjs/view-extension (0.0.43) potentially affected by CVE-2021-29624 via fastify-csrf (2.0.0)

fastify-csrf NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastify-csrf and may be impacted: - @nodosjs/view-extension 0.0.43 Source cves: CVE-2021-29624 Source advisory: MEND:CVE-2021-29624...

CVE-2021-29624

CVE-2021-29624 concerns fastify-csrf. Older releases (pre-3.1.0) use a double-submitted cookie CSRF mechanism across subdomains, which is addressed in 3.1.0. The vulnerability involves the optional userInfo parameter that binds the CSRF token to the user; if userInfo is missing or predictable, ne...

CVE-2021-29624: Reliance on Cookies without Validation and Integrity Checking

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

Cross-site Request Forgery (CSRF)

fastify-csrf is vulnerable to Cross-site Request Forgery CSRF. The vulnerability exists when fastify-csrf is used with the "double submit" mechanism using cookies with an application deployed across multiple subdomains...

Fastify Cross-Site Request Forgery Vulnerability

Fastify is an open source web framework for Node.js from the OpenJS Openjs Foundation. Node.js fastify suffers from a security vulnerability that allows an attacker to trigger cross-site request forgery via Cookie Double Submit in Node.js fastify-csrf in order to force the victim to perform an...