CVE-2020-8192

CVE-2020-8192 affects Fastify versions 2.14.1 and 3.0.0-rc.4. The vulnerability is a denial-of-service via resource exhaustion when the AJV-based validation uses the allErrors option and receives specially crafted schemas. The impact described in multiple connected records is that a malicious use...

Denial Of Service (DoS)

fastify is vulnerable to denial of service DoS. The default usage of allErrors: true in the ajv configuration allows an attacker to cause a denial of service condition...

Node.js third-party modules: Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS

I would like to report a denial of service vulnerability in fastify It allows to cause a DoS with some schemas that were otherwise assumed to be secure against DoS by their authors Module module name: fastify version: 2.14.1, 3.0.0-rc.4 npm page: https://www.npmjs.com/package/fastify Module...

Information Disclosure

apollo-server-fastify is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Exposure

Overview Versions of apollo-server-fastify prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Node.js: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Summary: Node.js is vulnerable to HTTP denial of service DOS attacks based on delayed requests submission which can make the server unable to accept new connections. Description: An attacker can open an arbitrary number of HTTP connections and keep the server busy by never completing the request...

fastify-multipart resource management error vulnerability

fastify-multipart is a package that supports parsing multiple content types. A resource management error vulnerability exists in versions prior to fastify-multipart 1.0.5, which can be exploited to crash an application with a specially crafted request...

CVE-2020-8136

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

CVE-2020-8136

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

Cross site request forgery (csrf)

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

CVE-2020-8136

CVE-2020-8136 affects fastify-multipart via a prototype-pollution path in versions below 1.0.5, enabling an attacker to crash Fastify applications during multipart request parsing with a crafted input. Connected advisories (GHSA-QH73-QC3P-RJV2 and RH/CVE entries) confirm a bypass vector involving...

CVE-2020-8136

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

Prototype Pollution

fastify-multipart is vulnerable to prototype pollution. It accepts parsing of multipart requests with proto key as field, allowing an attacker to provide such malicious requests to lead to an application crash in a remote server...

Node.js third-party modules: Prototype pollution in multipart parsing

I would like to report a prototype pollution attack in fastify-multipart it allows to crash a remote server parsing multipart requests by sending a specially crafted request. Module module name: fastify-multipart version: all versions before Detailed steps to reproduce with all required...

Code Injection

fastify is vulnerable to code injection. The vulnerability exists because the library serializes the data in the response using fast-json-stingify which is susceptible to Server Side Code Injection and it does not validate the properties names in schema definition, allowing an attacker to inject...

Node.js third-party modules: Server Side JavaScript Code Injection

I would like to report a Service Side JavaScript Code Injection in fastify. It allows an attacker that can control a single property name in the serialization schema to achieve Remote Command Execution in the context of the web server. Module module name: fastify version: 2.2.0 npm page:...

Denial of Service vulnerability with large JSON payloads in fastify

Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload. Recommendation Update to version 0.38.0 or later...

@axel92/nodejs-course (1.2.0), @brocan/bond (>=2.0.0, <=3.0.2) +17 more potentially affected by CVE-2018-3711 via fastify (>=0.5.0, <=0.37.0)

fastify NPM version =0.5.0, =2.0.0, =1.5.0, =0.0.1, =0.3.0, =0.1.0, =0.0.4, =0.0.1, =0.0.1, =0.12.0, =0.1.0, =0.1.1 - schnack 0.0.1-alpha and more Source cves: CVE-2018-3711 Source advisory: OSV:GHSA-MQ6C-FH97-4GWV...

GHSA-MQ6C-FH97-4GWV Denial of Service vulnerability with large JSON payloads in fastify

Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload. Recommendation Update to version 0.38.0 or later...

Fastify Denial of Service Vulnerability

Fastify is a web framework used in Node.js. A security vulnerability exists in Fastify versions prior to 0.38.0. An attacker can cause a denial of service by sending a request and payload with 'Content-Type: application/json'...