CVE-2022-41919

A Cross-site request forgery CSRF vulnerability was found in fastify due to improper handling of incorrect Content-Types. This flaw allows an attacker to use an incorrect 'Content-Type' to bypass checks to allow fetch requests that could be used to invoke routes that only accept application/json...

CVE-2022-41919 Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could...

CVE-2022-41919

CVE-2022-41919 : Fastify (web framework) is vulnerable to a CSRF risk due to bypass of Pre-Flight checks when requests use a non-JSON Content-Type (e.g., application/x-www-form-urlencoded, multipart/form-data, text/plain). This can bypass CORS protections and enable unauthorized cross-site action...

CVE-2022-41919 Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could...

@aeppic/install-build-server (>=1.2.0, <=1.9.8), @aeppic/install-repository-server (>=1.2.2, <=2.0.2) +145 more potentially affected by CVE-2022-41919 via fastify (>=3.0.0, <=3.29.3)

fastify NPM version =3.0.0, =1.2.0, =1.2.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0, =1.0.0, =4.23.1, =2.7.0, =1.0.0, =1.3.0 - @bronosorg/graph-indexer-service 1.0.0 and more Source cves: CVE-2022-41919 Source advisory: OSV:GHSA-3FJJ-P79J-C9HH...

@aicore/cocodb (>=1.0.1, <=1.0.6), @athenna/artisan (>=1.6.0, <=1.6.4) +92 more potentially affected by CVE-2022-41919 via fastify (>=4.0.2, <=4.10.0)

fastify NPM version =4.0.2, =1.0.1, =1.6.0, =1.3.1, =1.0.2, =1.2.1, =2.0.6, =1.4.6, =1.7.1, =1.3.0, =1.3.8, =1.0.1, =1.3.9, =4.33.5, =0.0.65, =1.1.1, =1.1.3 and more Source cves: CVE-2022-41919 Source advisory: OSV:GHSA-3FJJ-P79J-C9HH...