Description
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | fastify | Fixed in v2.15.1 and v3.0.0-rc.5. v1 not affected. | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fastify | < 2.15.1 | 2.15.1 | GHSA-xw5p-hw6r-2j98 |