fastify vulnerable to denial of service via malicious Content-Type

Mô tả

  const badNames = Object.getOwnPropertyNames({}.__proto__)
  fastify.addHook('onRequest', async (req, reply) => {
    for (const badName of badNames) {
      if (req.headers['content-type'].indexOf(badName) > -1) {
        reply.code(415)
        throw new Error('Content type not supported')
      }
    }
  })

Tham khảo

• fastify/fastify security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2022-39288 · ADVISORY
• fastify/fastify commit fbb07e8 · WEB
• fastify/fastify · PACKAGE
• fastify/fastify · WEB
• hackerone.com/bugs · WEB

Lỗ hổng khác của fastify

• CVE-2026-84428CAO 7.5fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema be…
• CVE-2026-84504CAO 8.1fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom val…
• CVE-2026-84469CAO 7.5fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines th…
• CVE-2026-76169CAO 7.5fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a diff…
• CVE-2026-18504TRUNG BÌNH 5.3fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass w…