High severity7.5NVD Advisory· Published Oct 10, 2022· Updated Jun 17, 2026
CVE-2022-39288
CVE-2022-39288
Description
fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit fbb07e8d and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fastifynpm | >= 4.0.0, < 4.8.1 | 4.8.1 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-455w-c45v-86rgghsaADVISORY
- github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgnvdMitigationThird Party AdvisoryWEB
- github.com/fastify/fastify/security/policynvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-39288ghsaADVISORY
- hackerone.com/bugsghsaWEB
News mentions
0No linked articles in our index yet.