PT-2022-24945 · Fastify · @Fastify/Websocket

Marcolanaro · Published 2022-11-07 · Updated 2022-11-09 · CVE-2022-39386

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fastify-websocket versions prior to 7.1.1 (fastify v4) and prior to 5.0.1 (fastify v3) @fastify/websocket (all versions, deprecated)

Description Any application using @fastify/websocket could crash if a specific, malformed packet is sent. The issue has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds, but it should be possible to attach the error handler manually.

Recommendations For fastify-websocket versions prior to 7.1.1 (fastify v4), upgrade to version 7.1.1 or later. For fastify-websocket versions prior to 5.0.1 (fastify v3), upgrade to version 5.0.1 or later. As a temporary workaround, consider attaching the error handler manually until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2022-39386

GHSA-4PCG-WR6C-H9CQ

Affected Products

@Fastify/Websocket

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39386.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-39386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39386 · Security Note
• https://osv.dev/vulnerability/GHSA-4pcg-wr6c-h9cq · Vendor Advisory
• https://github.com/fastify/fastify-websocket/commit/c24adeb3efd57a18b2f287c35d029e88b5a47194 · Note
• https://github.com/fastify/fastify-websocket/releases/tag/v5.0.1 · Note
• https://github.com/fastify/fastify-websocket · Note
• https://github.com/fastify/fastify-websocket/releases/tag/v7.1.1 · Note
• https://github.com/fastify/fastify-websocket/pull/228 · Note
• https://github.com/fastify/fastify-websocket/commit/7e8c41a51c101c3d5ce88caee4f71d9c29eb2863 · Note
• https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq · Note
• https://t.me/cvenotify/37330 · Telegram Post