PT-2022-24871 · Fastify · Fastify

B-I-T-K

·

Published

2022-10-10

·

Updated

2022-10-12

·

CVE-2022-39288

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions fastify versions 4.0.0 through 4.8.0
Description The issue allows an attacker to send an invalid Content-Type header, potentially causing the application to crash and leading to a denial of service attack. It is estimated that a significant number of devices using the fastify framework may be affected.
Recommendations For fastify versions 4.0.0 through 4.8.0, update to version 4.8.1 or later to resolve the issue. As a temporary workaround, consider adding a hook to reject malicious content types before the body parser enters action, using code such as:
const badNames = Object.getOwnPropertyNames({}. proto )
fastify.addHook('onRequest', async (req, reply) => {
 for (const badName of badNames) {
  if (req.headers['content-type'].indexOf(badName) > -1) {
   reply.code(415)
   throw new Error('Content type not supported')
  }
 }
})

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2022-39288
GHSA-455W-C45V-86RG

Affected Products

Fastify