fix(deps): update dependency fastify to v4.10.2 [security] #181

renovate · 2024-08-06T09:41:51Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fastify (source)	`4.9.2` -> `4.10.2`

GitHub Vulnerability Alerts

CVE-2022-39288

Impact

An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.

(This was updated: upon a close inspection, v3.x is not affected after all).

Patches

Yes, update to > v4.8.0.

Workarounds

You can reject the malicious content types before the body parser enters in action.

  const badNames = Object.getOwnPropertyNames({}.__proto__)
  fastify.addHook('onRequest', async (req, reply) => {
    for (const badName of badNames) {
      if (req.headers['content-type'].indexOf(badName) > -1) {
        reply.code(415)
        throw new Error('Content type not supported')
      }
    }
  })

References

See the HackerOne report #1715536

For more information

Fastify security policy

CVE-2022-41919

Impact

The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

Patches

For 4.x users, please update to at least 4.10.2
For 3.x users, please update to at least 3.29.4

Workarounds

Implement Cross-Site Request Forgery protection using @fastify/csrf.

References

Check out the HackerOne report: https://hackerone.com/reports/1763832.

For more information

Fastify security policy

Release Notes

fastify/fastify (fastify)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency fastify to v4.10.2 [security]

f51c3de

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency fastify to v4.10.2 [security] #181

fix(deps): update dependency fastify to v4.10.2 [security] #181

renovate bot commented Aug 6, 2024 •

edited

Loading

fix(deps): update dependency fastify to v4.10.2 [security] #181

Are you sure you want to change the base?

fix(deps): update dependency fastify to v4.10.2 [security] #181

Conversation

renovate bot commented Aug 6, 2024 • edited Loading

GitHub Vulnerability Alerts

CVE-2022-39288

Impact

Patches

Workarounds

References

For more information

CVE-2022-41919

Impact

Patches

Workarounds

References

For more information

Release Notes

v4.10.2

⚠️ Security Release ⚠️

v4.10.1

What's Changed

New Contributors

v4.10.0

What's Changed

New Contributors

Configuration

renovate bot commented Aug 6, 2024 •

edited

Loading

`v4.10.2`

`v4.10.1`

`v4.10.0`