Skip to content

Update dependency fastify to v5 [SECURITY]#90

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-fastify-vulnerability
Open

Update dependency fastify to v5 [SECURITY]#90
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-fastify-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 11, 2022 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastify (source) ^4.1.0 → ^5.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2022-39288

Impact

An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.

(This was updated: upon a close inspection, v3.x is not affected after all).

Patches

Yes, update to > v4.8.0.

Workarounds

You can reject the malicious content types before the body parser enters in action.

  const badNames = Object.getOwnPropertyNames({}.__proto__)
  fastify.addHook('onRequest', async (req, reply) => {
    for (const badName of badNames) {
      if (req.headers['content-type'].indexOf(badName) > -1) {
        reply.code(415)
        throw new Error('Content type not supported')
      }
    }
  })

References

See the HackerOne report #​1715536

For more information

Fastify security policy

CVE-2022-41919

Impact

The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

Patches

For 4.x users, please update to at least 4.10.2
For 3.x users, please update to at least 3.29.4

Workarounds

Implement Cross-Site Request Forgery protection using @fastify/csrf.

References

Check out the HackerOne report: https://hackerone.com/reports/1763832.

For more information

Fastify security policy

CVE-2026-25223

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

Release Notes

fastify/fastify (fastify)

v5.7.2

Compare Source

⚠️ Notice ⚠️

Parsing of the content-type header has been improved to a strict parser in PR #​6414. This means only header values in the form described in RFC 9110 are accepted.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.1...v5.7.2

v5.7.1

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.7.0...v5.7.1

v5.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.2...v5.7.0

v5.6.2

Compare Source

v5.6.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.0...v5.6.1

v5.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.5.0...v5.6.0

v5.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.3.3...v5.4.0

v5.3.3

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.2...v5.3.3

v5.3.2

Compare Source

⚠️ Security Release ⚠️

Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case.

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.1...v5.3.2

v5.3.1

Compare Source

⚠️ Security Release ⚠️
What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed
New Contributors

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ad37c2d to d03e7d7 Compare February 2, 2023 20:50
@renovate renovate bot changed the title Update dependency fastify to v4.8.1 [SECURITY] Update dependency fastify to v4.10.2 [SECURITY] Feb 2, 2023
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d03e7d7 to 1631858 Compare March 18, 2023 23:57
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 1631858 to 7646222 Compare April 3, 2023 16:30
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7646222 to 1e79e89 Compare April 17, 2023 14:15
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 1e79e89 to 15f380b Compare May 28, 2023 09:15
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 15f380b to 94ef381 Compare June 4, 2023 10:34
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 8c16b67 to 602c1c2 Compare June 18, 2023 08:33
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 602c1c2 to 5d47652 Compare June 29, 2023 09:40
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 562ab32 to 399f0c1 Compare July 9, 2023 09:55
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 399f0c1 to 0d3d5cf Compare July 19, 2023 11:11
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 0d3d5cf to f920122 Compare July 27, 2023 18:39
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f920122 to 1432d11 Compare August 9, 2023 12:47
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from af4b909 to 2c9e150 Compare August 27, 2023 08:28
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2c9e150 to 15a7916 Compare September 19, 2023 11:45
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from d09ce25 to f83459b Compare September 28, 2023 14:12
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from abf2738 to 7e20b19 Compare October 15, 2023 09:42
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7e20b19 to bb4d2f3 Compare October 23, 2023 15:23
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from bb4d2f3 to 5246efa Compare November 6, 2023 09:14
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 5246efa to 6e2ddac Compare November 16, 2023 09:55
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 6e2ddac to d89bee9 Compare December 3, 2023 12:33
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d89bee9 to 31ea73e Compare January 28, 2024 10:07
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 31ea73e to ed1008b Compare February 4, 2024 10:11
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ed1008b to 13a68a6 Compare February 25, 2024 09:33
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 13a68a6 to 97fc443 Compare March 12, 2024 09:45
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 97fc443 to e519389 Compare March 20, 2024 16:29
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from e519389 to 365a736 Compare April 14, 2024 08:26
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 365a736 to 84c6984 Compare April 25, 2024 08:20
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 84c6984 to ce0e8a0 Compare June 4, 2024 14:22
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ce0e8a0 to 09e992b Compare July 21, 2024 13:04
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 09e992b to 9f6f2d6 Compare August 6, 2024 09:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 9f6f2d6 to b25c47b Compare August 28, 2024 06:50
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from b25c47b to b26dc66 Compare October 9, 2024 11:45
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from b26dc66 to 4b2ef64 Compare December 2, 2024 13:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from a1edb27 to 7c19eab Compare January 30, 2025 14:26
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7c19eab to 27dc8ed Compare February 9, 2025 12:24
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 27dc8ed to 95cf067 Compare March 3, 2025 16:42
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 95cf067 to 73b0b4f Compare May 19, 2025 16:56
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 6aac200 to 5423cb2 Compare August 13, 2025 16:41
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 5423cb2 to e4b1e54 Compare August 31, 2025 10:46
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from e4b1e54 to f8b253f Compare September 25, 2025 16:13
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f8b253f to 3fbcfa8 Compare October 21, 2025 11:05
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 3fbcfa8 to 12e3fd5 Compare November 11, 2025 00:01
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 12e3fd5 to 45b56d7 Compare December 31, 2025 15:28
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 45b56d7 to 897dde6 Compare January 19, 2026 17:39
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 897dde6 to 791a1a2 Compare February 3, 2026 00:58
@renovate renovate bot changed the title Update dependency fastify to v4.10.2 [SECURITY] Update dependency fastify to v5 [SECURITY] Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants