Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@fastify/csrf-protection

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    Bypass of CSRF protection in the presence of predictable userInfo

    CVE-2023-27495 · GHSA-qrgf-9gpc-vrxw

    Affected
    • npm @fastify/csrf-protection < 4.1.0; >= 5.0.0, < 6.3.0
    Fixed in
    6.3.04.1.0· Vendor fix available
    Issue
    The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for CVE-2021-29624. Whenever userInfo parameter is missing, or its value can be predicted for the target user account, network and same-site attackers can 1. fixate a csrf cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism. As a fix, @fastify/csrf-protection starting from version 6.3.0 (and v4.1.0) includes a server-defined secret hmacKey that cryptographically binds the CSRF token to the value of the csrf cookie and the userInfo parameter, making tokens non-spoofable by attackers. This protection is…

    Recommended action: Upgrade to 6.3.0 or 4.1.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →