Packages / fastify / Security

ModerateVulnerabilityGHSA-xw5p-hw6r-2j98CVE-2020-8192Published 5 Aug 2020

Denial of service in fastify

Affected releases · fastify

  • 2.x2.0.0 – 2.15.0Fixed in 2.15.1
  • 1.x and older0.0.1 – 1.14.6No fix, no longer updated

On 2.x, the newest line:

npm install fastify@2.15.1
5.x

  1. Not affected

    5.0.0 – 5.12.7

    39 releases, latest

2.x

  1. Affected

    2.0.0 – 2.15.0

    22 releases

  2. Fixed

    2.15.1 – 2.15.3

    3 releases

1.x

  1. Affected

    1.0.0 – 1.14.6

    31 releases

0.x

  1. Affected

    0.0.1 – 0.43.0

    73 releases

300 stable releases of fastify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for fastify. It is read in your browser and sent nowhere.

What happens

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.