Packages / fastify / Security

HighVulnerabilityGHSA-mq6c-fh97-4gwvCVE-2018-3711Published 18 Jul 2018

Denial of Service vulnerability with large JSON payloads in fastify

Affected releases · fastify

  • 0.37.x and older0.0.1 – 0.37.0No fix, no longer updated

0.37.x has no fix yet; the newest fixed line:

npm install fastify@0.38.0
5.x

  1. Not affected

    5.0.0 – 5.12.7

    39 releases, latest

0.x

  1. Affected

    0.0.1 – 0.37.0

    66 releases

  2. Fixed

    0.38.0 – 0.43.0

    7 releases

300 stable releases of fastify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for fastify. It is read in your browser and sent nowhere.

What happens

Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload.

Recommendation

Update to version 0.38.0 or later.