CVE-2022-39288
highpriority · attend · 51EPSS 0.592 · 99 %ileEUUSEPSS · scored 2026-10-27
fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-455w-c45v-86rgfastify vulnerable to denial of service via malicious Content-Type2022-10-11ghsa · osvUS
### Impact An attacker can send an invalid `Content-Type` header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected. (This was updated: upon a close inspection, v3.x is not affected after all). ### Patches Yes, update to `> v4.8.0`. ### Workarounds You can reject the malicious content types before the body parser enters in action. ```js const badNames = Object.getOwnPropertyNames({}.__proto__) fastify.addHook('onRequest', async (req, reply) => { for (const badName of badNames) { if (req.headers['content-type'].indexOf(badName) > -1) { reply.code(415) throw new Error('Content type not supported') } } }) ``` ### References See the HackerOne report [#1715536](https://hackerone.com/bugs?report_id=1715536&subject=fastify) ### For more information [Fastify security policy](https://github.com/fastify/fastify/security/policy)
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-39288/cnnvd
- https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3cnnvd
- https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgcnnvd
- https://github.com/fastify/fastify/security/policycnnvd
- https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3enisa_euvd
- https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgenisa_euvd
- https://github.com/fastify/fastify/security/policyenisa_euvd
- https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3PatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan