Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. Details fastify applications rely on the @fastify/passport library for user authentication. The login and user validation are performed by the authenticate function. When executing this function, the sessionId is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid sessionId cookie in the victim's browser and waiting for the victim to log in on the website. Fix As a solution, newer versions of @fastify/passport regenerate sessionId upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Credits Pedro Adão (@pedromigueladao), Instituto Superior Técnico, University of Lisbon Marco Squarcina (@lavish), Security &…
Recommended action: Upgrade to 2.3.0 or 1.1.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The CSRF protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport, can be bypassed by network and same-site attackers. Details fastify/csrf-protection implements the synchronizer token pattern (using plugins @fastify/session and @fastify/secure-session) by storing a random value used for CSRF token generation in the csrf attribute of a user's session. The @fastify/passport library does not clear the session object upon authentication, preserving the csrf attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. Fix As a solution, newer versions of @fastify/passport include the configuration options clearSessionOnLogin (default: true) and…
Recommended action: Upgrade to 2.3.0 or 1.1.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.