High severityNVD Advisory· Published Oct 10, 2022· Updated Apr 23, 2025
Denial of service in Fastify via Content-Type header
CVE-2022-39288
Description
fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit fbb07e8d and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fastifynpm | >= 4.0.0, < 4.8.1 | 4.8.1 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-455w-c45v-86rgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-39288ghsaADVISORY
- github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3ghsaWEB
- github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgghsaWEB
- github.com/fastify/fastify/security/policyghsaWEB
- hackerone.com/bugsghsaWEB
News mentions
0No linked articles in our index yet.