Medium severity5.9NVD Advisory· Published Jan 19, 2021· Updated Jun 17, 2026
CVE-2020-28482
CVE-2020-28482
Description
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fastify-csrfnpm | < 3.0.0 | 3.0.0 |
Affected products
3- fastify-csrf/fastify-csrfdescription
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-49wp-qq6x-g2rfghsaADVISORY
- github.com/fastify/fastify-csrf/pull/26nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-28482ghsaADVISORY
- snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044nvdThird Party AdvisoryWEB
- github.com/fastify/fastify-csrf/commit/3c9de36e9e73ce0eda9207f84f2ac0243e1f5253ghsaWEB
- www.npmjs.com/package/fastify-csrfghsaWEB
News mentions
0No linked articles in our index yet.