Skip to content

Product

fastify-csrf vulnerabilities

2 published CVES affecting fastify-csrf, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest fastify-csrf CVEs

Newest publication first

  1. CVE-2021-29624 Lack of protection against cookie tossing attacks in fastify-csrf

    Published
    MediumCVSS 6.5 EPSS 0.83%

    fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform a...

  2. CVE-2020-28482 Cross-site Request Forgery (CSRF)

    Published
    HighCVSS 8.8 EPSS 0.99%

    This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.