Skip to content

Product

npm tiny-csrf vulnerabilities

1 published CVE affecting npm tiny-csrf, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest npm tiny-csrf CVEs

Newest publication first

  1. CVE-2022-39287 Plaintext transmission of CSRF tokens in tiny-csrf

    Published
    MediumCVSS 6.5 EPSS 0.52%

    tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit 8eead6d and the patch with be included in version 1.1....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.