HighGHSA-mq6c-fh97-4gwvCVE-2018-3711

Denial of Service vulnerability with large JSON payloads in fastify

Published 18 Jul 2018 · Updated 8 Nov 2023

Affected package

Affected: <0.38.0
Fixed in: 0.38.0

Update to the fixed version for your release line, for example:npm install fastify@0.38.0

Details

Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload.

Recommendation

Update to version 0.38.0 or later.

Is GHSA-mq6c-fh97-4gwv in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fastify, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2018-3711
Linkgithub.com/fastify/fastify/pull/627
Linkgithub.com/fastify/fastify/commit/fabd2a011f2ffbb877394abe699f549513ffbd76
Linkhackerone.com/reports/303632
Advisorygithub.com/advisories/GHSA-mq6c-fh97-4gwv
Linkwww.npmjs.com/advisories/564

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.