High severity7.5NVD Advisory· Published Nov 8, 2022· Updated Jun 17, 2026
CVE-2022-39386
CVE-2022-39386
Description
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@fastify/websocketnpm | >= 5.0.0, < 5.0.1 | 5.0.1 |
@fastify/websocketnpm | >= 6.0.0, < 7.1.1 | 7.1.1 |
fastify-websocketnpm | <= 4.3.0 | — |
Affected products
5- ghsa-coords2 versions
>= 5.0.0, < 5.0.1+ 1 more
- (no CPE)range: >= 5.0.0, < 5.0.1
- (no CPE)range: <= 4.3.0
- fastify/fastify-websocketv5Range: >= 5.0.0, < 5.0.1
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-4pcg-wr6c-h9cqghsaADVISORY
- github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cqnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-39386ghsaADVISORY
- github.com/fastify/fastify-websocket/commit/7e8c41a51c101c3d5ce88caee4f71d9c29eb2863ghsaWEB
- github.com/fastify/fastify-websocket/commit/c24adeb3efd57a18b2f287c35d029e88b5a47194ghsaWEB
- github.com/fastify/fastify-websocket/pull/228ghsaWEB
- github.com/fastify/fastify-websocket/releases/tag/v5.0.1ghsaWEB
- github.com/fastify/fastify-websocket/releases/tag/v7.1.1ghsaWEB
News mentions
0No linked articles in our index yet.