Skip to content
OpenAdvisories

Package · npm

fastify-csrf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-29624

    Lack of protection against cookie tossing attacks in fastify-csrf

    fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "her…

    fastify fastify-csrf fastify-csrf npm
  • Medium 5.9
    CVE-2020-28482

    Cross-site Request Forgery (CSRF)

    This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

    fastify-csrf npm