CVE-2022-39287

CVE-2022-39287 affects tiny-csrf, a Node.js CSRF protection middleware. In versions prior to 1.1.0 cookies were not encrypted, causing CSRF tokens to be transmitted in the clear. The issue is addressed in commit 8eead6d, with the patch planned for inclusion in version 1.1.0. Users should upgrade ...