High severityNVD Advisory· Published Nov 8, 2022· Updated Apr 23, 2025
fastify-websocket vulnerable to uncaught exception via crash on malformed packet
CVE-2022-39386
Description
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@fastify/websocketnpm | >= 5.0.0, < 5.0.1 | 5.0.1 |
@fastify/websocketnpm | >= 6.0.0, < 7.1.1 | 7.1.1 |
fastify-websocketnpm | <= 4.3.0 | — |
Affected products
3- ghsa-coords2 versions
>= 5.0.0, < 5.0.1+ 1 more
- (no CPE)range: >= 5.0.0, < 5.0.1
- (no CPE)range: <= 4.3.0
- fastify/fastify-websocketv5Range: >= 5.0.0, < 5.0.1
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-4pcg-wr6c-h9cqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-39386ghsaADVISORY
- github.com/fastify/fastify-websocket/commit/7e8c41a51c101c3d5ce88caee4f71d9c29eb2863ghsaWEB
- github.com/fastify/fastify-websocket/commit/c24adeb3efd57a18b2f287c35d029e88b5a47194ghsaWEB
- github.com/fastify/fastify-websocket/pull/228ghsaWEB
- github.com/fastify/fastify-websocket/releases/tag/v5.0.1ghsaWEB
- github.com/fastify/fastify-websocket/releases/tag/v7.1.1ghsaWEB
- github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cqghsaWEB
News mentions
0No linked articles in our index yet.