1392 matches found
Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN
I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...
@brunnerlivio/terminus (>=6.3.1, <=6.5.2), @eik/core (>=1.0.0-alpha.9, <=1.0.0-alpha.14) +54 more potentially affected by CVE-2020-8192 via fastify (>=2.0.0-rc.4, <=2.15.0)
fastify NPM version =2.0.0-rc.4, =6.3.1, =1.0.0-alpha.9, =1.0.0-alpha.1, =0.0.1, =2.0.0-alpha.1, =0.0.1, =0.0.1, =0.1.12, =0.0.10, =0.2.0, =1.7.0, =2.1.0, =6.0.1, =6.2.0-rc.0, =6.5.6 and more Source cves: CVE-2020-8192 Source advisory: GHSA-XW5P-HW6R-2J98...
Denial of service in fastify
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
GHSA-XW5P-HW6R-2J98 Denial of service in fastify
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
@brunnerlivio/terminus (>=6.3.1, <=6.5.2), @eik/core (>=1.0.0-alpha.9, <=1.0.0-alpha.14) +54 more potentially affected by CVE-2020-8192 via fastify (>=2.0.0-rc.4, <=2.15.0)
fastify NPM version =2.0.0-rc.4, =6.3.1, =1.0.0-alpha.9, =1.0.0-alpha.1, =0.0.1, =2.0.0-alpha.1, =0.0.1, =0.0.1, =0.1.12, =0.0.10, =0.2.0, =1.7.0, =2.1.0, =6.0.1, =6.2.0-rc.0, =6.5.6 and more Source cves: CVE-2020-8192 Source advisory: OSV:GHSA-XW5P-HW6R-2J98...
Fastify Resource Management Error Vulnerability
Fastify is an OpenJS Foundation open source web framework for Node.js. A resource management error vulnerability exists in Fastify versions v2.14.1 and v3.0.0-rc.4. An attacker can exploit this vulnerability to cause resource exhaustion denial of service...
CVE-2020-8192
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
CVE-2020-8192
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
Denial of service
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
CVE-2020-8192
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
46c-sector (>=1.0.0, <=1.2.1), @agentframework/cli (>=0.9.6, <=0.11.1) +191 more potentially affected by CVE-2020-8192 via fastify (>=0.5.0, <=2.15.0)
fastify NPM version =0.5.0, =1.0.0, =0.9.6, =0.3.0, =2.0.0, =6.3.1, =1.0.0, =0.1.0, =0.0.1, =1.0.0-alpha.9, =1.0.0-alpha.1, =0.0.3, =1.1.3, =0.0.1, =0.0.12 and more Source cves: CVE-2020-8192 Source advisory: MEND:CVE-2020-8192...
CVE-2020-8192
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
CVE-2020-8192
CVE-2020-8192 affects Fastify versions 2.14.1 and 3.0.0-rc.4. The vulnerability is a denial-of-service via resource exhaustion when the AJV-based validation uses the allErrors option and receives specially crafted schemas. The impact described in multiple connected records is that a malicious use...
CVE-2020-8192
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
Denial Of Service (DoS)
fastify is vulnerable to denial of service DoS. The default usage of allErrors: true in the ajv configuration allows an attacker to cause a denial of service condition...
PT-2020-20016
Name of the Vulnerable Software and Affected Versions Fastify versions 2.14.1 and 3.0.0-rc.4 Description A denial of service issue exists that allows a malicious user to trigger resource exhaustion with specially crafted schemas when the allErrors option is used. Recommendations For Fastify versi...
CVE-2020-8192: Uncontrolled Resource Consumption
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas...
Node.js third-party modules: Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS
I would like to report a denial of service vulnerability in fastify It allows to cause a DoS with some schemas that were otherwise assumed to be secure against DoS by their authors Module module name: fastify version: 2.14.1, 3.0.0-rc.4 npm page: https://www.npmjs.com/package/fastify Module...
Information Disclosure
apollo-server-fastify is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...
Information Exposure
Overview Versions of apollo-server-fastify prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...